Not a member of Pastebin yet?
Sign Up,
it unlocks many cool features!
- <?php
- $input = "[youtube=http://www.youtube.com/watch?v=VIDEO_ID_HERE&hl=en&fs=1]";
- if ( preg_match('/[youtube=.*?v=(.*?)&.*?]/i', $input, $matches ) )
- {
- $sanitizedVideoId = urlencode( strip_tags( $matches[1] ) );
- echo 'param name="movie" value="http://www.youtube.com/v/' . $sanitizedVideoId . '&hl=en&fs=1&rel=0';
- } else {
- // Not valid input
- }
- <?php
- $input = "[youtube=http://www.youtube.com/watch?v="><script src="http://example.com/xss.js"></script>&hl=en&fs=1]";
- // Is vulnerable to XSS
- echo preg_replace('/[youtube=.*?v=(.*?)&.*?]/i', 'param name="movie" value="http://www.youtube.com/v/$1&hl=en&fs=1&rel=0', $input );
- echo "n";
- // Prevents XSS
- if ( preg_match('/[youtube=.*?v=(.*?)&.*?]/i', $input, $matches ) )
- {
- $sanitizedVideoId = urlencode( strip_tags( $matches[1] ) );
- echo 'param name="movie" value="http://www.youtube.com/v/' . $sanitizedVideoId . '&hl=en&fs=1&rel=0';
- } else {
- // Not valid input
- }
- $str = preg_replace('/[youtube=.*?v=([a-z0-9_-]+?)&.*?]/i', 'param name="movie" value="http://www.youtube.com/v/$1&hl=en&fs=1&rel=0', $str);
- / - Start of RE
- [ - A literal [ ([ is a special character so it needs escaping)
- youtube= - Make sure we've got the right tag
- .*? - Any old rubbish, but don't be greedy; stop when we reach...
- v= - ...this text
- ([a-z0-9_-]+?) - Take some more text (just z-a 0-9 _ and -), and don't be greedy. Capture it using (). This will get put in $1
- &.*?] - the junk up to the ending ]
- /i - end the RE and make it case-insensitive for the hell of it
- $originalURL = 'http://www.youtube.com/watch?v=VIDEO_ID_HERE&hl=en&fs=1';
- foreach( parse_url( $originalURL, PHP_URL_QUERY) as $keyvalue )
- {
- if ( strlen( $keyvalue ) > 2 && substr( $keyvalue, 0, 2 ) == 'v=' )
- {
- $videoId = substr( $keyvalue, 2 );
- break;
- }
- }
- $newURL = sprintf( 'http://www.youtube.com/v/%s/whatever/else', url_encode( $videoId ) );
- $embedString = 'youtube=http://www.youtube.com/watch?v=VIDEO_ID_HERE&hl=en&fs=1';
- preg_match('/v=([^&]*)/',$embedstring,$matches);
- echo 'param name="movie" value="http://www.youtube.com/v/'.$matches[1].'&hl=en&fs=1&rel=0';
- $str = preg_replace('/[youtube=[^]]*?v=([^]]*?)&[^]]*?]/i', ...)
Add Comment
Please, Sign In to add comment