我正在使用HTMLPurifier来转义我网站中的字符。有效地将所有<和>变成>和<。我还想在网站中显示代码，但是当使用<pre><code>...</code></pre>将代码放到网站上时，不是将>和<符号渲染为<和>，而是将它们作为编码的>显示。
我知道<pre>标签用于显示预格式化的文本
我如何安全地转换这些符号（>和<），只有当用<pre><code>...</code></pre>标签包装才能使用JS / JQuery呈现为（<和>）？
<php 'default' => 'local'皈依<php 'default' => 'local'
注意：渲染HTML标记时不会发生这种情况。我相信它是由HTMLPurifier引起的。
HTML正确呈现为
<div>
...Some code here...
</div>
我在网站上使用Markdown，我的HTMLPurifier配置如下：
<?php
/**
* Ok, glad you are here
* first we get a config instance, and set the settings
* $config = HTMLPurifier_Config::createDefault();
* $config->set('Core.Encoding', $this->config->get('purifier.encoding'));
* $config->set('Cache.SerializerPath', $this->config->get('purifier.cachePath'));
* if ( ! $this->config->get('purifier.finalize')) {
* $config->autoFinalize = false;
* }
* $config->loadArray($this->getConfig());
*
* You must NOT delete the default settings
* anything in settings should be compacted with params that needed to instance HTMLPurifier_Config.
*
* @link http://htmlpurifier.org/live/configdoc/plain.html
*/
return [
'encoding' => 'UTF-8',
'finalize' => true,
'cachePath' => storage_path('app/purifier'),
'cacheFileMode' => 0755,
'settings' => [
'default' => [
'HTML.Doctype' => 'HTML 4.01 Transitional',
'HTML.Allowed' => 'blockquote,h1,h2,h3,h4,h5,h6,pre,code,div[class],b,strong,i,em,a[href|title],ul,ol,li,p[style],br,span[style],img[width|height|alt|src]',
'CSS.AllowedProperties' => 'font,font-size,font-weight,font-style,font-family,text-decoration,padding-left,color,background-color,text-align',
'AutoFormat.AutoParagraph' => false,
'AutoFormat.RemoveEmpty' => true,
],
'test' => [
'Attr.EnableID' => true
],
"youtube" => [
"HTML.SafeIframe" => 'true',
"URI.SafeIframeRegexp" => "%^(http://|https://|//)(www.youtube.com/embed/|player.vimeo.com/video/)%",
],
],
];
This is the method I'm using to call the Purifier
public function store(Request $request)
{
//Validate the data
$this->validate($request, array(
'title' => 'required|max:255',
'slug' => 'required|alpha_dash|min:5|max:255|unique:posts,slug',
'category_id' =>'required|integer',
'body' => 'required'
));
//Store in the database
$post = new Post;
$post->title = $request->title;
$post->slug = $request->slug;
$post->category_id = $request->category_id;
$post->body = Purifier::clean($request->body, "youtube");
$post->save();
$post->tags()->sync($request->tags, false);
Session::flash('success', 'AWESOMESAUCE! Your post was saved successfully!');
//redirect to another page
return redirect()->route('posts.show', $post->id);
}
这个问题让我搜索了以前的代码。问题来自Markdown解析器，它是Parsedown而不是Purifier。净化器工作正常。我在下面添加了Markdown配置和使用代码：
<?php
/*
* This file is part of Laravel Markdown.
*
* (c) Graham Campbell <[email protected]>
*
* For the full copyright and license information, please view the LICENSE
* file that was distributed with this source code.
*/
return [
/*
|--------------------------------------------------------------------------
| Enable View Integration
|--------------------------------------------------------------------------
|
| This option specifies if the view integration is enabled so you can write
| markdown views and have them rendered as html. The following extensions
| are currently supported: ".md", ".md.php", and ".md.blade.php". You may
| disable this integration if it is conflicting with another package.
|
| Default: true
|
*/
'views' => true,
/*
|--------------------------------------------------------------------------
| CommonMark Extenstions
|--------------------------------------------------------------------------
|
| This option specifies what extensions will be automatically enabled.
| Simply provide your extension class names here.
|
| Default: []
|
*/
'extensions' => [],
/*
|--------------------------------------------------------------------------
| Renderer Configuration
|--------------------------------------------------------------------------
|
| This option specifies an array of options for rendering HTML.
|
| Default: [
| 'block_separator' => "\n",
| 'inner_separator' => "\n",
| 'soft_break' => "\n",
| ]
|
*/
'renderer' => [
'block_separator' => "\n",
'inner_separator' => "\n",
'soft_break' => "\n",
],
/*
|--------------------------------------------------------------------------
| Enable Em Tag Parsing
|--------------------------------------------------------------------------
|
| This option specifies if `<em>` parsing is enabled.
|
| Default: true
|
*/
'enable_em' => true,
/*
|--------------------------------------------------------------------------
| Enable Strong Tag Parsing
|--------------------------------------------------------------------------
|
| This option specifies if `<strong>` parsing is enabled.
|
| Default: true
|
*/
'enable_strong' => true,
/*
|--------------------------------------------------------------------------
| Enable Asterisk Parsing
|--------------------------------------------------------------------------
|
| This option specifies if `*` should be parsed for emphasis.
|
| Default: true
|
*/
'use_asterisk' => true,
/*
|--------------------------------------------------------------------------
| Enable Underscore Parsing
|--------------------------------------------------------------------------
|
| This option specifies if `_` should be parsed for emphasis.
|
| Default: true
|
*/
'use_underscore' => true,
/*
|--------------------------------------------------------------------------
| Safe Mode
|--------------------------------------------------------------------------
|
| This option specifies if raw HTML is rendered in the document. Setting
| this to true will not render HTML, and false will.
|
| Default: false
|
*/
'safe' => true,
];
用法：
<img class="img-responsive" src="{{ asset('assets/img/' . $post->image) }}" alt="{{ $post->alt }}" />
{!! Markdown::parse($post->body) !!}
<hr />
使用htmlspecialchars（）函数来实现此目的，htmlspecialchars（）函数将预定义字符“<”（小于）和“>”（大于）转换为HTML实体：
<?php
$str = "This is some <b>bold</b> text.";
echo htmlspecialchars($str);
?>
这将打印：
This is some <b>bold</b> text.
我已经解决了在Purifier配置中添加HTML.Allowed属性的问题：
pre[class],code
然后我使用以下方法清理代码：
$post->body = clean($request->body, "youtube");
如果您使用TinyMCE作为编辑器，您还必须添加属性extended_valid_elements：
extended_valid_elements: 'a[href|target],pre[class],code',