51 |
return mysql_fetch_array($result); |
return mysql_fetch_array($result); |
52 |
} |
} |
53 |
|
|
|
function diary_strip_tags ($string) { |
|
|
$string = strip_tags($string,"<p><b><i><a><em><br><strong><blockquote><cite><q><tt><li><ol><ul><div><hr>"); |
|
|
$string = only_href($string); |
|
|
return $string; |
|
|
} |
|
|
|
|
|
function only_href($string) { |
|
|
|
|
|
# Den här funktionen letar upp HTML-taggar, delar upp dem i element och alla attribut, |
|
|
# och anropar only_href_attr. |
|
|
|
|
|
$string = preg_replace('%<'. |
|
|
'(/?[a-z]+)'. # element |
|
|
'(\s+'. # mellanrum |
|
|
'(\'[^\']*\'|"[^"]*"|[^<>])*)'. # alla attribut |
|
|
'>%ei', |
|
|
'only_href_attr(\'\\1\', \'\\2\')', $string); |
|
|
return $string; |
|
|
} |
|
|
|
|
|
function only_href_attr($element, $attr) { |
|
|
|
|
|
# Den här funktionen tar bort alla attribut, om elementet inte är <a>. |
|
|
# Om det är <a> delar den upp attributlistan i olika attribut, och anropar |
|
|
# only_href_attr_check. |
|
|
|
|
|
$attr = stripslashes(stripslashes($attr)); |
|
|
|
|
|
if (strtolower($element) != 'a') |
|
|
return "<$element>"; |
|
|
|
|
|
$attr = preg_replace('%(\s+([^=\s]+)'. # attributnamn |
|
|
'(\s*=\s*'. # lika med |
|
|
'(\'[^\']*\'|"[^"]*"|\S+))?)%ei', # attributvärde |
|
|
'only_href_attr_check(\'\\2\', \'\\1\')', $attr); |
|
|
|
|
|
$attr = trim($attr); |
|
|
if ($attr != '') |
|
|
$attr = " $attr"; |
|
|
|
|
|
return "<$element$attr>"; |
|
|
} |
|
|
|
|
|
function only_href_attr_check($attributename, $wholeattribute) { |
|
|
|
|
|
# Den här funktionen tar bort alla attribut som inte är href=, samt de |
|
|
# href-attribut som inte är välformade. |
|
|
|
|
|
$wholeattribute = stripslashes($wholeattribute); |
|
|
|
|
|
if (strtolower($attributename) != 'href') |
|
|
return ''; |
|
|
|
|
|
if ((!preg_match('%^\s+[^=\s]+\s*=\s*\'[^\']*\'$%', $wholeattribute)) and |
|
|
(!preg_match('%^\s+[^=\s]+\s*=\s*"[^"]*"$%', $wholeattribute)) and |
|
|
(preg_match('%["\']%', $wholeattribute))) |
|
|
return ''; |
|
|
|
|
|
return $wholeattribute; |
|
|
} |
|
|
|
|
54 |
function diary_display($did=0, $user=false) { |
function diary_display($did=0, $user=false) { |
55 |
global $loggeduser; |
global $loggeduser; |
56 |
dbconnect(); |
dbconnect(); |
111 |
include('config.php'); |
include('config.php'); |
112 |
global $did,$loggeduser,$diary,$REQUEST_METHOD,$action,$op; |
global $did,$loggeduser,$diary,$REQUEST_METHOD,$action,$op; |
113 |
dbconnect(); |
dbconnect(); |
114 |
$diary['title'] = strip_tags($diary['title']); |
$diary['title'] = new_check_html($diary['title'], 'nohtml'); |
115 |
$diary['bodytext'] = diary_strip_tags($diary['bodytext']); |
$diary['bodytext'] = new_check_html($diary['bodytext']); |
116 |
if (($op == "add") or ($did == 0)) { |
if (($op == "add") or ($did == 0)) { |
117 |
$result = mysql_query("SELECT did,NOW()-time FROM diary WHERE aid='$loggeduser' ORDER BY did DESC LIMIT 1"); |
$result = mysql_query("SELECT did,NOW()-time FROM diary WHERE aid='$loggeduser' ORDER BY did DESC LIMIT 1"); |
118 |
list($yourdid,$secs) = @mysql_fetch_row($result); |
list($yourdid,$secs) = @mysql_fetch_row($result); |