Replacing characters with html codes, but excluding html tags

This site is best viewed in a modern browser with JavaScript enabled.

Replacing characters with html codes, but excluding html tags

Mindzai

I have a string which contains html markup. As an example:

<p class="foo">Some text in a paragraph "which may be quoted & have special chars" in it</p>
<p>It is true that <span>1</span> > 5, but not that 1 > 0</p>

As you can see there might be some special characters, and ultimately this HTML is going to be rendered and I don't want plain characters like " and &, i want " and & etc.

Obviously I can't just run this through htmlspecialchars() because that would convert the HTML tags too.

I want to end up with this:

<p class="foo">Some text in a paragraph &quot;which may be quoted &amp; have special chars&quot; in it</p>
<p>It is true that <span>1</span> &gt; 5, but not that 1 &gt; 0</p>

Does anyone know of a way of converting these characters when they are outside of an HTML tag? I'm thinking it might have to be done using a regex (which isn't my strong point!) since I can't guarantee that the code will be well-formed XML.

criterion9

You could use htmlspecialchars and then switch back the html entities using a search and replace all the > and <.

Mindzai

What about the quotes around attributes though? Or < and > within the actual content? The more I think about this the more I think I might just have to enforce well-formed content and use xml_parse().

criterion9

I didn't think about that. That's probably your best bet then.

Mindzai

Hmmmm I'm still struggling with this.

Using an XML parser doesn't work, because it falls over it finds characters like & and < in the string. This is obviously a problem as the entire point is to find those characters and fix them.

There must be some way of taking some HTML source and replacing html entities within the tags?

bokeh

I'm not saying it's bulletproof but maybe something like this:

$subject = preg_replace_callback(
	'/(?<=\>)((?![<]\/*[a-z][^>]*[>]).)+/is',
	create_function(
		'$matches',
		'return htmlspecialchars($matches[0]);'
	),
	$subject
);

Mindzai

Thanks a lot, that seems to work nicely from my initial tests. Is there an easy way of skipping any php content (ie between <?php and ?>) that may exist? This is the only issue I still seem to be having. So for example the following:

$input = '<p class=\"test\">A string with < and > and & and " characters.</p><p>PHP tags are <?php echo "broken"; ?> though...</p>';

Is currently returned like this:

<p class="test">A string with &lt; and &gt; and &amp; and &quot; characters.</p> <p>PHP tags are &lt;?php echo &quot;broken&quot;; ?&gt; though...</p>

I could just replace <?php and ?> with <?php and ?>, but it would be neater if they could be left untouched in the first place.

EDIT: actually replacing <?php and ?> would only be part of the problem anyway - i'd still have any & and " characters within the PHP itself which would get converted.

bokeh

You could try it like this:

/(?<=\>)((?![<](\?|\/)*[a-z][^>]*[>]).)+/is

But it all depends what's between those PHP tags that might upset the regex. If it's just a basic echo statement like here though it should be ok.

But php that contains html tags would break it. <?php echo '<html>' ?> for example.

bokeh

I think for anything more complex you would need to cut it up into different strings and use more specific regexes in each case (a two or three step process rather than a one size fits all regex).

Mindzai

Hmmmm yes sometimes the PHP could be fairly complex. I think I might try what you suggest, if I split out the string based on the php <?php and ?> tags, I could then just apply this callback to the non-php portions of the string, then stick it back together after.

Mindzai

OK this is what I've got, fingers crossed it seems to work OK, thanks for the help:

function cleanEntities($string) {

$string = htmlspecialchars_decode($string);

$parts = preg_split('/(<\?.+?\?>)/', $string, -1, PREG_SPLIT_DELIM_CAPTURE);

$string = '';

foreach ($parts as $part) {
    if (false === mb_strpos(trim($part), '<?')) {
        $string .= preg_replace_callback(
            '/(?<=\>)((?![<](\?|\/)*[a-z][^>]*[>]).)+/is',
            create_function(
                '$matches',
                'return htmlspecialchars($matches[0]);'
            ),
            $part
        );
    } else {
        $string .= $part;
    }
}

return $string;

}

Mindzai

Noticed a small bug but I'm unable to edit:

$parts = preg_split('/(<\?.+?\?>)/', $string, -1, PREG_SPLIT_DELIM_CAPTURE);

Should be:

$parts = preg_split('/(<\?.+?\?>)/us', $string, -1, PREG_SPLIT_DELIM_CAPTURE);

The modifiers needed to be added to the regex.

bokeh

<\?.+?\?>

Maybe not important but that will split on an xml tag.

<?xml version="1.0" encoding="UTF-8" standalone="yes"?>

Mindzai

Yes i did think that, though I dont anticipate having any XML in the string. Maybe I'd be better with something like this though:

/(<\?(php|=).+?\?>)/us

batool100

wow well its easy if you want to put copyright sign just write & copy ; same as © or you can write numbers, you dont put space in there, if you want more updates you can you cab join blogs.

batool100

and if you need all kind of HTML codes help just earch in http://www.webdevelopmentseo.com/website/html-forum-f2.html its best place where you can find all kind of help about html, php etc.