demo.php

   1 <?php
   2
   3 // using _REQUEST because we accept GET and POST requests
   4
   5 $content = empty($_REQUEST['xml']) ? 'text/html' : 'application/xhtml+xml';
   6 header("Content-type:$content;charset=UTF-8");
   7
   8 // prevent PHP versions with shorttags from barfing
   9 echo '<?xml version="1.0" encoding="UTF-8" ?>
  10 ';
  11
  12 function getFormMethod() {
  13     return (isset($_REQUEST['post'])) ? 'post' : 'get';
  14 }
  15
  16 if (empty($_REQUEST['strict'])) {
  17 ?><!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
  18      "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
  19 <?php
  20 } else {
  21 ?>
  22 <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
  23     "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
  24 <?php
  25 }
  26 ?>
  27 <html xmlns="http://www.w3.org/1999/xhtml" lang="en" xml:lang="en">
  28 <head>
  29 <title>HTML Purifier Live Demo</title>
  30 <meta http-equiv="Content-Type" content="text/html; charset=UTF-8" />
  31 </head>
  32 <body>
  33 <h1>HTML Purifier Live Demo</h1>
  34 <?php
  35
  36 require_once 'live/library/HTMLPurifier.auto.php';
  37
  38 if (!empty($_REQUEST['html'])) { // start result
  39
  40     if (strlen($_REQUEST['html']) > 50000) {
  41         ?>
  42         <p>Request exceeds maximum allowed text size of 50kb.</p>
  43         <?php
  44     } else { // start main processing
  45
  46     $html = get_magic_quotes_gpc() ? stripslashes($_REQUEST['html']) : $_REQUEST['html'];
  47
  48     $config = HTMLPurifier_Config::createDefault();
  49     $config->set('Core', 'TidyFormat', !empty($_REQUEST['tidy']));
  50     $config->set('HTML', 'Strict',     !empty($_REQUEST['strict']));
  51     $purifier = new HTMLPurifier($config);
  52     $pure_html = $purifier->purify($html);
  53
  54 ?>
  55 <p>Here is your purified HTML:</p>
  56 <div style="border:5px solid #CCC;margin:0 10%;padding:1em;">
  57 <?php if(getFormMethod() == 'get') { ?>
  58 <div style="float:right;">
  59     <a href="http://validator.w3.org/check?uri=referer"><img
  60         src="http://www.w3.org/Icons/valid-xhtml10"
  61         alt="Valid XHTML 1.0 Transitional" height="31" width="88" style="border:0;" /></a>
  62 </div>
  63 <?php } ?>
  64 <?php
  65
  66 echo $pure_html;
  67
  68 ?>
  69 <div style="clear:both;"></div>
  70 </div>
  71 <p>Here is the source code of the purified HTML:</p>
  72 <pre><?php
  73
  74 echo htmlspecialchars($pure_html, ENT_COMPAT, 'UTF-8');
  75
  76 ?></pre>
  77 <?php
  78 if (getFormMethod() == 'post') { // start POST validation notice
  79 ?>
  80 <p>If you would like to validate the code with
  81 <a href="http://validator.w3.org/#validate-by-input">W3C's
  82 validator</a>, copy and paste the <em>entire</em> demo page's source.</p>
  83 <?php
  84 } // end POST validation notice
  85
  86 } // end main processing
  87
  88 // end result
  89 } else {
  90
  91 ?>
  92 <p>Welcome to the live demo.  Enter some HTML and see how HTML Purifier
  93 will filter it.</p>
  94 <?php
  95
  96 }
  97
  98 ?>
  99 <form id="filter" action="demo.php<?php
 100 echo '?' . getFormMethod();
 101 if (isset($_REQUEST['profile']) || isset($_REQUEST['XDEBUG_PROFILE'])) {
 102     echo '&amp;XDEBUG_PROFILE=1';
 103 } ?>" method="<?php echo getFormMethod();  ?>">
 104     <fieldset>
 105         <legend>HTML Purifier Input (<?php echo getFormMethod(); ?>)</legend>
 106         <textarea name="html" cols="60" rows="15"><?php
 107
 108 if (isset($html)) {
 109     echo htmlspecialchars(
 110             HTMLPurifier_Encoder::cleanUTF8($html), ENT_COMPAT, 'UTF-8');
 111 }
 112         ?></textarea>
 113         <?php if (getFormMethod() == 'get') { ?>
 114             <p><strong>Warning:</strong> GET request method can only hold
 115                 8129 characters (probably less depending on your browser).
 116                 If you need to test anything
 117                 larger than that, try the <a href="demo.php?post">POST form</a>.</p>
 118         <?php } ?>
 119         <?php if (extension_loaded('tidy')) { ?>
 120             <div>Nicely format output with Tidy? <input type="checkbox" value="1"
 121             name="tidy"<?php if (!empty($_REQUEST['tidy'])) echo ' checked="checked"'; ?> /></div>
 122         <?php } ?>
 123         <div>XHTML 1.0 Strict output? <input type="checkbox" value="1"
 124         name="strict"<?php if (!empty($_REQUEST['strict'])) echo ' checked="checked"'; ?> /></div>
 125         <div>Serve as application/xhtml+xml? (not for IE) <input type="checkbox" value="1"
 126         name="xml"<?php if (!empty($_REQUEST['xml'])) echo ' checked="checked"'; ?> /></div>
 127         <div>
 128             <input type="submit" value="Submit" name="submit" class="button" />
 129         </div>
 130     </fieldset>
 131 </form>
 132 <p>Return to <a href="http://hp.jpsband.org/">HTML Purifier's home page</a>.
 133 Try the form in <a href="demo.php?get">GET</a> and <a href="demo.php?post">POST</a> request
 134 flavors (GET is easy to validate with W3C, but POST allows larger inputs).</p>
 135 </body>
 136 </html>