demo.php

   1 <?php
   2
   3 // major TODO: hook into some sort of templating system that utilizes
   4 // XHTML Compiler to process the template (cacheable, of course), before
   5 // passing it along to this script
   6
   7 // using _REQUEST because we accept GET and POST requests
   8
   9 function getFormMethod() {
  10     return (isset($_REQUEST['post'])) ? 'post' : 'get';
  11 }
  12 function escapeHTML($html) {
  13     return htmlspecialchars(
  14         HTMLPurifier_Encoder::cleanUTF8($html), ENT_COMPAT, 'UTF-8');
  15 }
  16 function isLocal() {
  17     return file_exists('xhtml-compiler/local.txt');
  18 }
  19
  20 if (!isLocal()) {
  21     if (empty($_REQUEST['experimental'])) {
  22         require_once 'live/library/HTMLPurifier.auto.php';
  23     } else {
  24         require_once 'dev/library/HTMLPurifier.auto.php';
  25     }
  26 } else {
  27     // local dev
  28     require_once '../htmlpurifier/library/HTMLPurifier.auto.php';
  29 }
  30 require_once 'HTMLPurifier/Printer/ConfigForm.php';
  31
  32 $allowed_lite = array(
  33     'Core.CollectErrors',
  34     'URI.DisableExternalResources',
  35     'URI.Munge',
  36     'HTML.TidyLevel',
  37     'HTML.Doctype',
  38     'HTML.Allowed',
  39     'CSS',
  40     'AutoFormat',
  41     '-AutoFormat.Custom',
  42     '-AutoFormat.PurifierLinkify',
  43 );
  44
  45 $config = HTMLPurifier_Config::loadArrayFromForm($_REQUEST, 'filter', $allowed_lite);
  46
  47 if (!empty($_REQUEST['strict'])) {
  48     // backwards-compatibility
  49     $config->set('HTML', 'Strict', true);
  50 }
  51 if (!empty($_REQUEST['experimental'])) {
  52     require_once 'HTMLPurifier/Lexer/PH5P.php';
  53     $config->set('Core', 'LexerImpl', 'PH5P');
  54 }
  55
  56 $definition = $config->getHTMLDefinition();
  57 $doctype = $definition->doctype;
  58
  59 if ($doctype->xml && stripos($_SERVER["HTTP_ACCEPT"], 'application/xhtml+xml') !== false && !isset($_REQUEST['debug'])) {
  60     $type = 'application/xhtml+xml';
  61 } else {
  62     $type = 'text/html';
  63 }
  64 header("Content-type:$type;charset=UTF-8");
  65
  66 // prevent PHP versions with shorttags from barfing
  67 if ($doctype->xml) {
  68     echo '<?xml version="1.0" encoding="UTF-8" ?>' . PHP_EOL;
  69 }
  70
  71 if (!empty($doctype->dtdPublic) && !empty($doctype->dtdSystem)) {
  72     echo '<!DOCTYPE html PUBLIC "'.$doctype->dtdPublic.'" "'.$doctype->dtdSystem.'">' . PHP_EOL;
  73 }
  74
  75 if ($doctype->xml) {
  76     echo '<html xmlns="http://www.w3.org/1999/xhtml" lang="en" xml:lang="en">' . PHP_EOL;
  77     $END = ' /';
  78 } else {
  79     echo '<html lang="en">' . PHP_EOL;
  80     $END = '';
  81 }
  82
  83 ?><head>
  84     <title>HTML Purifier Live Demo</title>
  85     <!-- make sure all empty elements that are not generated are
  86      appropriately ended -->
  87     <meta name="author" content="Edward Z. Yang"<?php echo $END; ?>>
  88     <meta http-equiv="Content-Type" content="text/html; charset=UTF-8"<?php echo $END; ?>>
  89     <link rel="icon" href="favicon.ico" type="image/x-icon"<?php echo $END; ?>>
  90     <link rel="shortcut icon" href="favicon.ico" type="image/x-icon"<?php echo $END; ?>>
  91     <link rel="stylesheet" href="common.css" type="text/css"<?php echo $END; ?>>
  92     <link rel="stylesheet" href="demo.css" type="text/css"<?php echo $END; ?>>
  93     <link rel="stylesheet" href="live/library/HTMLPurifier/Printer/ConfigForm.css" type="text/css"<?php echo $END; ?>>
  94     <script defer="defer" type="text/javascript" src="live/library/HTMLPurifier/Printer/ConfigForm.js"></script>
  95 </head>
  96 <body>
  97 <div id="logo"></div>
  98 <div id="header"><a href=".">HTML Purifier</a></div>
  99 <?php readfile('navigation.frag'); ?>
 100 <h1 id="title">Live Demo</h1>
 101 <div id="alt-content">
 102 <?php
 103
 104 if (!empty($_REQUEST['html'])) { // start result
 105
 106     if (strlen($_REQUEST['html']) > 50000) {
 107         ?>
 108         <p>Request exceeds maximum allowed text size of 50kb.</p>
 109         <?php
 110     } else { // start main processing
 111
 112     $html = get_magic_quotes_gpc() ? stripslashes($_REQUEST['html']) : $_REQUEST['html'];
 113     $purifier = new HTMLPurifier($config);
 114     $pure_html = $purifier->purify($html);
 115
 116 ?>
 117 <p>Here is your purified HTML:</p>
 118 <div id="output">
 119 <?php if(getFormMethod() == 'get') {
 120 // calculate image
 121 $img = false;
 122 if ($doctype->name == 'HTML 4.01 Transitional' || $doctype->name == 'HTML 4.01 Strict') {
 123     $img = 'http://www.w3.org/Icons/valid-html401';
 124 } elseif ($doctype->name == 'XHTML 1.0 Transitional' || $doctype->name == 'XHTML 1.0 Strict') {
 125     $img = 'http://www.w3.org/Icons/valid-xhtml10';
 126 } elseif ($doctype->name == 'XHTML 1.1') {
 127     $img = 'http://www.w3.org/Icons/valid-xhtml11';
 128 }
 129 ?>
 130   <div id="w3c-validator">
 131     <a href="http://validator.w3.org/check?uri=referer" title="Valid <?php echo escapeHTML($doctype->name); ?>">
 132     <?php if ($img) { ?>
 133       <img
 134         src="<?php echo escapeHTML($img); ?>" height="31" width="88"
 135         alt="Valid <?php echo escapeHTML($doctype->name); ?>"<?php echo $END; ?>>
 136     <?php } else { ?>
 137       Valid <?php echo escapeHTML($doctype->name); ?>
 138     <?php } ?>
 139     </a>
 140   </div>
 141 <?php } ?>
 142 <?php
 143
 144 echo $pure_html;
 145
 146 ?>
 147 <div class="clear"></div>
 148 </div>
 149 <?php if ($config->get('Core', 'CollectErrors')) {
 150     $e = $purifier->context->get('ErrorCollector');
 151     $class = $e->getRaw() ? 'fail' : 'pass';
 152 ?>
 153     <p>Here are errors that occurred during purification:</p>
 154     <div id="errors" class="<?php echo $class ?>">
 155     <?php
 156     echo $e->getHTMLFormatted($config);
 157     ?>
 158 </div>
 159 <?php } ?>
 160 <p>Here is the source code of the purified HTML:</p>
 161 <pre id="source"><?php echo escapeHTML($pure_html); ?></pre>
 162 <?php
 163 if (getFormMethod() == 'post') { // start POST validation notice
 164 ?>
 165     <p>If you would like to validate the code with
 166     <a href="http://validator.w3.org/#validate-by-input">W3C's
 167     validator</a>, copy and paste the <em>entire</em> demo page's source.</p>
 168 <?php
 169 } // end POST validation notice
 170
 171 } // end main processing
 172
 173 // end result
 174 } else {
 175
 176 ?>
 177 <p>Welcome to the live demo.  Enter some HTML and see how HTML Purifier
 178 will filter it.</p>
 179 <?php
 180
 181 }
 182
 183 ?>
 184 <form id="filter" action="demo.php<?php
 185 echo '?' . getFormMethod();
 186 if (isset($_REQUEST['profile']) || isset($_REQUEST['XDEBUG_PROFILE'])) {
 187     echo '&amp;XDEBUG_PROFILE=1';
 188 } ?>" method="<?php echo getFormMethod();  ?>">
 189     <fieldset>
 190         <legend>HTML Purifier Input (<?php echo getFormMethod(); ?>)</legend>
 191
 192         <?php
 193 $form_printer = new HTMLPurifier_Printer_ConfigForm('filter', 'http://htmlpurifier.org/live/configdoc/plain.html#%s', 14);
 194 echo $form_printer->render($config, $allowed_lite, false);
 195         ?>
 196
 197         <div id="textarea">
 198         <textarea name="html" cols="60" rows="15"><?php
 199 if (isset($html)) echo escapeHTML($html);
 200         ?></textarea>
 201         </div>
 202
 203         <?php if (getFormMethod() == 'get') { ?>
 204             <p><strong>Warning:</strong> GET request method can only hold
 205                 8129 characters (probably less depending on your browser).
 206                 If you need to test anything
 207                 larger than that, try the <a href="?post">POST form</a>.</p>
 208         <?php } ?>
 209         <div>
 210             <input type="submit" value="Submit" name="submit" class="button"<?php echo $END; ?>>
 211             Use experimental features: <input type="checkbox" value="1" <?php if(!empty($_REQUEST['experimental'])) {echo 'checked="checked" ';} ?>name="experimental"<?php echo $END; ?>>
 212         </div>
 213     </fieldset>
 214 </form>
 215 <p>Try the form in <a href="?get">GET</a> and <a href="?post">POST</a> request
 216 flavors (GET is easy to validate with W3C, but POST allows larger inputs).
 217 Don't know what to test? Try out these sample filterings:</p>
 218 <ul>
 219     <li><a href="demo.php?html=%3Cimg+src%3D%22javascript%3Aevil%28%29%3B%22+onload%3D%22evil%28%29%3B%22+%2F%3E">Malicious code removed</a></li>
 220     <li><a href="demo.php?html=%3Cb%3EBold&amp;submit=Submit">Missing end tags fixed</a></li>
 221     <li><a href="demo.php?html=%3Cb%3EInline+%3Cdel%3Econtext+%3Cdiv%3ENo+block+allowed%3C%2Fdiv%3E%3C%2Fdel%3E%3C%2Fb%3E&amp;submit=Submit">Illegal nesting fixed</a></li>
 222     <li><a href="demo.php?html=%3Ccenter%3ECentered%3C%2Fcenter%3E&amp;filter%5BHTML.Doctype%5D=XHTML+1.0+Strict&amp;submit=Submit">Deprecated tags converted</a></li>
 223     <li><a href="demo.php?html=%3Cspan+style%3D%22color%3A%23COW%3Bfloat%3Aaround%3Btext-decoration%3Ablink%3B%22%3EText%3C%2Fspan%3E&amp;submit=Submit"><abbr>CSS</abbr> validated</a></li>
 224     <li><a href="demo.php?html=%3Ctable%3E%0D%0A++%3Ccaption%3E%0D%0A++++Cool+table%0D%0A++%3C%2Fcaption%3E%0D%0A++%3Ctfoot%3E%0D%0A++++%3Ctr%3E%0D%0A++++++%3Cth%3EI+can+do+so+much%21%3C%2Fth%3E%0D%0A++++%3C%2Ftr%3E%0D%0A++%3C%2Ftfoot%3E%0D%0A++%3Ctr%3E%0D%0A++++%3Ctd+style%3D%22font-size%3A16pt%3B%0D%0A++++++color%3A%23F00%3Bfont-family%3Asans-serif%3B%0D%0A++++++text-align%3Acenter%3B%22%3EWow%3C%2Ftd%3E%0D%0A++%3C%2Ftr%3E%0D%0A%3C%2Ftable%3E&amp;submit=Submit">Rich formatting preserved</a></li>
 225 </ul>
 226 </div>
 227 </body>
 228 </html>