PageRenderTime 66ms CodeModel.GetById 24ms RepoModel.GetById 1ms app.codeStats 0ms

/vendor/htmlawed/htmlawed.php

http://github.com/fuel/core
PHP | 766 lines | 679 code | 29 blank | 58 comment | 346 complexity | ec3dff0c7e680c43f7ffbcf30202819b MD5 | raw file
Possible License(s): BSD-3-Clause

Large files files are truncated, but you can click here to view the full file

    

  1. <?php
    2. 

  2. 

  3. /*
    4. 

  4. htmLawed 1.2.4.2, 16 May 2019
    5. 

  5. Copyright Santosh Patnaik
    6. 

  6. Dual licensed with LGPL 3 and GPL 2+
    7. 

  7. A PHP Labware internal utility - www.bioinformatics.org/phplabware/internal_utilities/htmLawed
    8. 

    9. 

  9. See htmLawed_README.txt/htm
    10. 

  10. */
    11. 

  11. 

  12. function htmLawed($t, $C=1, $S=array()){
    13. 

  13. $C = is_array($C) ? $C : array();
    14. 

  14. if(!empty($C['valid_xhtml'])){
    15. 

  15.  $C['elements'] = empty($C['elements']) ? '*-acronym-big-center-dir-font-isindex-s-strike-tt' : $C['elements'];
    16. 

  16.  $C['make_tag_strict'] = isset($C['make_tag_strict']) ? $C['make_tag_strict'] : 2;
    17. 

  17.  $C['xml:lang'] = isset($C['xml:lang']) ? $C['xml:lang'] : 2;
    18. 

  18. }
    19. 

  19. // config eles
    20. 

  20. $e = array('a'=>1, 'abbr'=>1, 'acronym'=>1, 'address'=>1, 'applet'=>1, 'area'=>1, 'article'=>1, 'aside'=>1, 'audio'=>1, 'b'=>1, 'bdi'=>1, 'bdo'=>1, 'big'=>1, 'blockquote'=>1, 'br'=>1, 'button'=>1, 'canvas'=>1, 'caption'=>1, 'center'=>1, 'cite'=>1, 'code'=>1, 'col'=>1, 'colgroup'=>1, 'command'=>1, 'data'=>1, 'datalist'=>1, 'dd'=>1, 'del'=>1, 'details'=>1, 'dfn'=>1, 'dir'=>1, 'div'=>1, 'dl'=>1, 'dt'=>1, 'em'=>1, 'embed'=>1, 'fieldset'=>1, 'figcaption'=>1, 'figure'=>1, 'font'=>1, 'footer'=>1, 'form'=>1, 'h1'=>1, 'h2'=>1, 'h3'=>1, 'h4'=>1, 'h5'=>1, 'h6'=>1, 'header'=>1, 'hgroup'=>1, 'hr'=>1, 'i'=>1, 'iframe'=>1, 'img'=>1, 'input'=>1, 'ins'=>1, 'isindex'=>1, 'kbd'=>1, 'keygen'=>1, 'label'=>1, 'legend'=>1, 'li'=>1, 'link'=>1, 'main'=>1, 'map'=>1, 'mark'=>1, 'menu'=>1, 'meta'=>1, 'meter'=>1, 'nav'=>1, 'noscript'=>1, 'object'=>1, 'ol'=>1, 'optgroup'=>1, 'option'=>1, 'output'=>1, 'p'=>1, 'param'=>1, 'pre'=>1, 'progress'=>1, 'q'=>1, 'rb'=>1, 'rbc'=>1, 'rp'=>1, 'rt'=>1, 'rtc'=>1, 'ruby'=>1, 's'=>1, 'samp'=>1, 'script'=>1, 'section'=>1, 'select'=>1, 'small'=>1, 'source'=>1, 'span'=>1, 'strike'=>1, 'strong'=>1, 'style'=>1, 'sub'=>1, 'summary'=>1, 'sup'=>1, 'table'=>1, 'tbody'=>1, 'td'=>1, 'textarea'=>1, 'tfoot'=>1, 'th'=>1, 'thead'=>1, 'time'=>1, 'tr'=>1, 'track'=>1, 'tt'=>1, 'u'=>1, 'ul'=>1, 'var'=>1, 'video'=>1, 'wbr'=>1); // 118 incl. deprecated & some Ruby
    21. 

  21. 

  22. if(!empty($C['safe'])){
    23. 

  23.  unset($e['applet'], $e['audio'], $e['canvas'], $e['embed'], $e['iframe'], $e['object'], $e['script'], $e['video']);
    24. 

  24. }
    25. 

  25. $x = !empty($C['elements']) ? str_replace(array("\n", "\r", "\t", ' '), '', $C['elements']) : '*';
    26. 

  26. if($x == '-*'){$e = array();}
    27. 

  27. elseif(strpos($x, '*') === false){$e = array_flip(explode(',', $x));}
    28. 

  28. else{
    29. 

  29.  if(isset($x[1])){
    30. 

  30.   preg_match_all('`(?:^|-|\+)[^\-+]+?(?=-|\+|$)`', $x, $m, PREG_SET_ORDER);
    31. 

  31.   for($i=count($m); --$i>=0;){$m[$i] = $m[$i][0];}
    32. 

  32.   foreach($m as $v){
    33. 

  33.    if($v[0] == '+'){$e[substr($v, 1)] = 1;}
    34. 

  34.    if($v[0] == '-' && isset($e[($v = substr($v, 1))]) && !in_array('+'. $v, $m)){unset($e[$v]);}
    35. 

  35.   }
    36. 

  36.  }
    37. 

  37. }
    38. 

  38. $C['elements'] =& $e;
    39. 

  39. // config attrs
    40. 

  40. $x = !empty($C['deny_attribute']) ? strtolower(str_replace(array("\n", "\r", "\t", ' '), '', $C['deny_attribute'])) : '';
    41. 

  41. $x = array_flip((isset($x[0]) && $x[0] == '*') ? str_replace('/', 'data-', explode('-', str_replace('data-', '/', $x))) : explode(',', $x. (!empty($C['safe']) ? ',on*' : '')));
    42. 

  42. $C['deny_attribute'] = $x;
    43. 

  43. // config URLs
    44. 

  44. $x = (isset($C['schemes'][2]) && strpos($C['schemes'], ':')) ? strtolower($C['schemes']) : 'href: aim, feed, file, ftp, gopher, http, https, irc, mailto, news, nntp, sftp, ssh, tel, telnet'. (empty($C['safe']) ? ', app, javascript; *: data, javascript, ' : '; *:'). 'file, http, https';
    45. 

  45. $C['schemes'] = array();
    46. 

  46. foreach(explode(';', trim(str_replace(array(' ', "\t", "\r", "\n"), '', $x), ';')) as $v){
    47. 

  47.  $x = $x2 = null; list($x, $x2) = explode(':', $v, 2);
    48. 

  48.  if($x2){$C['schemes'][$x] = array_flip(explode(',', $x2));}
    49. 

  49. }
    50. 

  50. if(!isset($C['schemes']['*'])){
    51. 

  51.  $C['schemes']['*'] = array('file'=>1, 'http'=>1, 'https'=>1);
    52. 

  52.  if(empty($C['safe'])){$C['schemes']['*'] += array('data'=>1, 'javascript'=>1);}
    53. 

  53. }
    54. 

  54. if(!empty($C['safe']) && empty($C['schemes']['style'])){$C['schemes']['style'] = array('!'=>1);}
    55. 

  55. $C['abs_url'] = isset($C['abs_url']) ? $C['abs_url'] : 0;
    56. 

  56. if(!isset($C['base_url']) or !preg_match('`^[a-zA-Z\d.+\-]+://[^/]+/(.+?/)?$`', $C['base_url'])){
    57. 

  57.  $C['base_url'] = $C['abs_url'] = 0;
    58. 

  58. }
    59. 

  59. // config rest
    60. 

  60. $C['and_mark'] = empty($C['and_mark']) ? 0 : 1;
    61. 

  61. $C['anti_link_spam'] = (isset($C['anti_link_spam']) && is_array($C['anti_link_spam']) && count($C['anti_link_spam']) == 2 && (empty($C['anti_link_spam'][0]) or hl_regex($C['anti_link_spam'][0])) && (empty($C['anti_link_spam'][1]) or hl_regex($C['anti_link_spam'][1]))) ? $C['anti_link_spam'] : 0;
    62. 

  62. $C['anti_mail_spam'] = isset($C['anti_mail_spam']) ? $C['anti_mail_spam'] : 0;
    63. 

  63. $C['balance'] = isset($C['balance']) ? (bool)$C['balance'] : 1;
    64. 

  64. $C['cdata'] = isset($C['cdata']) ? $C['cdata'] : (empty($C['safe']) ? 3 : 0);
    65. 

  65. $C['clean_ms_char'] = empty($C['clean_ms_char']) ? 0 : $C['clean_ms_char'];
    66. 

  66. $C['comment'] = isset($C['comment']) ? $C['comment'] : (empty($C['safe']) ? 3 : 0);
    67. 

  67. $C['css_expression'] = empty($C['css_expression']) ? 0 : 1;
    68. 

  68. $C['direct_list_nest'] = empty($C['direct_list_nest']) ? 0 : 1;
    69. 

  69. $C['hexdec_entity'] = isset($C['hexdec_entity']) ? $C['hexdec_entity'] : 1;
    70. 

  70. $C['hook'] = (!empty($C['hook']) && function_exists($C['hook'])) ? $C['hook'] : 0;
    71. 

  71. $C['hook_tag'] = (!empty($C['hook_tag']) && function_exists($C['hook_tag'])) ? $C['hook_tag'] : 0;
    72. 

  72. $C['keep_bad'] = isset($C['keep_bad']) ? $C['keep_bad'] : 6;
    73. 

  73. $C['lc_std_val'] = isset($C['lc_std_val']) ? (bool)$C['lc_std_val'] : 1;
    74. 

  74. $C['make_tag_strict'] = isset($C['make_tag_strict']) ? $C['make_tag_strict'] : 1;
    75. 

  75. $C['named_entity'] = isset($C['named_entity']) ? (bool)$C['named_entity'] : 1;
    76. 

  76. $C['no_deprecated_attr'] = isset($C['no_deprecated_attr']) ? $C['no_deprecated_attr'] : 1;
    77. 

  77. $C['parent'] = isset($C['parent'][0]) ? strtolower($C['parent']) : 'body';
    78. 

  78. $C['show_setting'] = !empty($C['show_setting']) ? $C['show_setting'] : 0;
    79. 

  79. $C['style_pass'] = empty($C['style_pass']) ? 0 : 1;
    80. 

  80. $C['tidy'] = empty($C['tidy']) ? 0 : $C['tidy'];
    81. 

  81. $C['unique_ids'] = isset($C['unique_ids']) && (!preg_match('`\W`', $C['unique_ids'])) ? $C['unique_ids'] : 1;
    82. 

  82. $C['xml:lang'] = isset($C['xml:lang']) ? $C['xml:lang'] : 0;
    83. 

  83. 

  84. if(isset($GLOBALS['C'])){$reC = $GLOBALS['C'];}
    85. 

  85. $GLOBALS['C'] = $C;
    86. 

  86. $S = is_array($S) ? $S : hl_spec($S);
    87. 

  87. if(isset($GLOBALS['S'])){$reS = $GLOBALS['S'];}
    88. 

  88. $GLOBALS['S'] = $S;
    89. 

  89. 

  90. $t = preg_replace('`[\x00-\x08\x0b-\x0c\x0e-\x1f]`', '', $t);
    91. 

  91. //Clean out any microsoft characters
    92. 

  92. if ($C['clean_ms_char']) {
    93. 

  93. 	/**
    94. 

  94. 	* Note: CHANGED: This diverges from the htmLawed standard method to prevent breaking UTF-8
    95. 

  95. 	*/
    96. 

  96. 

  97. 	//Convert Microsoft smarty quotes to boring quotes
    98. 

  98. 	$quotes = array(
    99. 

  99. 	"\xC2\xAB" => '"', // (U+00AB) in UTF-8
    100. 

  100. 	"\xC2\xBB" => '"', // (U+00BB) in UTF-8
    101. 

  101. 	"\xE2\x80\x83" => " ", // (U+2003) in UTF-8
    102. 

  102. 	"\xE2\x80\x98" => "'", // (U+2018) in UTF-8
    103. 

  103. 	"\xE2\x80\x99" => "'", // (U+2019) in UTF-8
    104. 

  104. 	"\xE2\x80\x9A" => "'", // (U+201A) in UTF-8
    105. 

  105. 	"\xE2\x80\x9B" => "'", // (U+201B) in UTF-8
    106. 

  106. 	"\xE2\x80\x9C" => '"', // (U+201C) in UTF-8
    107. 

  107. 	"\xE2\x80\x9D" => '"', // (U+201D) in UTF-8
    108. 

  108. 	"\xE2\x80\x9E" => '"', // (U+201E) in UTF-8
    109. 

  109. 	"\xE2\x80\x9F" => '"', // (U+201F) in UTF-8
    110. 

  110. 	"\xE2\x80\xB9" => "'", // (U+2039) in UTF-8
    111. 

  111. 	"\xE2\x80\xBA" => "'", // (U+203A) in UTF-8
    112. 

  112. 	);
    113. 

  113. 	$t = strtr($t, $quotes);
    114. 

  114. 

  115. 	//Taken from http://www.php.net/manual/en/function.strtr.php#40253
    116. 

  116. 	$badlatin1_cp1252_to_htmlent = array(
    117. 

  117. 	'\x80'=>'&#x20AC;', '\x81'=>'?', '\x82'=>'&#x201A;', '\x83'=>'&#x0192;',
    118. 

  118. 	'\x84'=>'&#x201E;', '\x85'=>'&#x2026;', '\x86'=>'&#x2020;', '\x87'=>'&#x2021;',
    119. 

  119. 	'\x88'=>'&#x02C6;', '\x89'=>'&#x2030;', '\x8A'=>'&#x0160;', '\x8B'=>'&#x2039;',
    120. 

  120. 	'\x8C'=>'&#x0152;', '\x8D'=>'?', '\x8E'=>'&#x017D;', '\x8F'=>'?',
    121. 

  121. 	'\x90'=>'?', '\x91'=>'&#x2018;', '\x92'=>'&#x2019;', '\x93'=>'&#x201C;',
    122. 

  122. 	'\x94'=>'&#x201D;', '\x95'=>'&#x2022;', '\x96'=>'&#x2013;', '\x97'=>'&#x2014;',
    123. 

  123. 	'\x98'=>'&#x02DC;', '\x99'=>'&#x2122;', '\x9A'=>'&#x0161;', '\x9B'=>'&#x203A;',
    124. 

  124. 	'\x9C'=>'&#x0153;', '\x9D'=>'?', '\x9E'=>'&#x017E;', '\x9F'=>'&#x0178;'
    125. 

  125. 	);
    126. 

  126. 	$t = strtr($t, $badlatin1_cp1252_to_htmlent);
    127. 

  127. }
    128. 

  128. if($C['clean_ms_char']){
    129. 

  129.  $x = array("\x7f"=>'', "\x80"=>'&#8364;', "\x81"=>'', "\x83"=>'&#402;', "\x85"=>'&#8230;', "\x86"=>'&#8224;', "\x87"=>'&#8225;', "\x88"=>'&#710;', "\x89"=>'&#8240;', "\x8a"=>'&#352;', "\x8b"=>'&#8249;', "\x8c"=>'&#338;', "\x8d"=>'', "\x8e"=>'&#381;', "\x8f"=>'', "\x90"=>'', "\x95"=>'&#8226;', "\x96"=>'&#8211;', "\x97"=>'&#8212;', "\x98"=>'&#732;', "\x99"=>'&#8482;', "\x9a"=>'&#353;', "\x9b"=>'&#8250;', "\x9c"=>'&#339;', "\x9d"=>'', "\x9e"=>'&#382;', "\x9f"=>'&#376;');
    130. 

  130.  $x = $x + ($C['clean_ms_char'] == 1 ? array("\x82"=>'&#8218;', "\x84"=>'&#8222;', "\x91"=>'&#8216;', "\x92"=>'&#8217;', "\x93"=>'&#8220;', "\x94"=>'&#8221;') : array("\x82"=>'\'', "\x84"=>'"', "\x91"=>'\'', "\x92"=>'\'', "\x93"=>'"', "\x94"=>'"'));
    131. 

  131.  $t = strtr($t, $x);
    132. 

  132. }
    133. 

  133. if($C['cdata'] or $C['comment']){$t = preg_replace_callback('`<!(?:(?:--.*?--)|(?:\[CDATA\[.*?\]\]))>`sm', 'hl_cmtcd', $t);}
    134. 

  134. $t = preg_replace_callback('`&amp;([a-zA-Z][a-zA-Z0-9]{1,30}|#(?:[0-9]{1,8}|[Xx][0-9A-Fa-f]{1,7}));`', 'hl_ent', str_replace('&', '&amp;', $t));
    135. 

  135. if($C['unique_ids'] && !isset($GLOBALS['hl_Ids'])){$GLOBALS['hl_Ids'] = array();}
    136. 

  136. if($C['hook']){$t = $C['hook']($t, $C, $S);}
    137. 

  137. if($C['show_setting'] && preg_match('`^[a-z][a-z0-9_]*$`i', $C['show_setting'])){
    138. 

  138.  $GLOBALS[$C['show_setting']] = array('config'=>$C, 'spec'=>$S, 'time'=>microtime());
    139. 

  139. }
    140. 

  140. // main
    141. 

  141. $t = preg_replace_callback('`<(?:(?:\s|$)|(?:[^>]*(?:>|$)))|>`m', 'hl_tag', $t);
    142. 

  142. $t = $C['balance'] ? hl_bal($t, $C['keep_bad'], $C['parent']) : $t;
    143. 

  143. $t = (($C['cdata'] or $C['comment']) && strpos($t, "\x01") !== false) ? str_replace(array("\x01", "\x02", "\x03", "\x04", "\x05"), array('', '', '&', '<', '>'), $t) : $t;
    144. 

  144. $t = $C['tidy'] ? hl_tidy($t, $C['tidy'], $C['parent']) : $t;
    145. 

  145. unset($C, $e);
    146. 

  146. if(isset($reC)){$GLOBALS['C'] = $reC;}
    147. 

  147. if(isset($reS)){$GLOBALS['S'] = $reS;}
    148. 

  148. return $t;
    149. 

  149. }
    150. 

  150. 

  151. function hl_attrval($a, $t, $p){
    152. 

  152. // check attr val against $S
    153. 

  153. static $ma = array('accesskey', 'class', 'itemtype', 'rel');
    154. 

  154. $s = in_array($a, $ma) ? ' ' : ($a == 'srcset' ? ',': '');
    155. 

  155. $r = array();
    156. 

  156. $t = !empty($s) ? explode($s, $t) : array($t);
    157. 

  157. foreach($t as $tk=>$tv){
    158. 

  158.  $o = 1; $tv = trim($tv); $l = strlen($tv);
    159. 

  159.  foreach($p as $k=>$v){
    160. 

  160.   if(!$l){continue;}
    161. 

  161.   switch($k){
    162. 

  162.    case 'maxlen': if($l > $v){$o = 0;}
    163. 

  163.    break; case 'minlen': if($l < $v){$o = 0;}
    164. 

  164.    break; case 'maxval': if((float)($tv) > $v){$o = 0;}
    165. 

  165.    break; case 'minval': if((float)($tv) < $v){$o = 0;}
    166. 

  166.    break; case 'match': if(!preg_match($v, $tv)){$o = 0;}
    167. 

  167.    break; case 'nomatch': if(preg_match($v, $tv)){$o = 0;}
    168. 

  168.    break; case 'oneof':
    169. 

  169.     $m = 0;
    170. 

  170.     foreach(explode('|', $v) as $n){if($tv == $n){$m = 1; break;}}
    171. 

  171.     $o = $m;
    172. 

  172.    break; case 'noneof':
    173. 

  173.     $m = 1;
    174. 

  174.     foreach(explode('|', $v) as $n){if($tv == $n){$m = 0; break;}}
    175. 

  175.     $o = $m;
    176. 

  176.    break; default:
    177. 

  177.    break;
    178. 

  178.   }
    179. 

  179.   if(!$o){break;}
    180. 

  180.  }
    181. 

  181.  if($o){$r[] = $tv;}
    182. 

  182. }
    183. 

  183. if($s == ','){$s = ', ';}
    184. 

  184. $r = implode($s, $r);
    185. 

  185. return (isset($r[0]) ? $r : (isset($p['default']) ? $p['default'] : 0));
    186. 

  186. }
    187. 

  187. 

  188. function hl_bal($t, $do=1, $in='div'){
    189. 

  189. // balance tags
    190. 

  190. // by content
    191. 

  191. $cB = array('blockquote'=>1, 'form'=>1, 'map'=>1, 'noscript'=>1); // Block
    192. 

  192. $cE = array('area'=>1, 'br'=>1, 'col'=>1, 'command'=>1, 'embed'=>1, 'hr'=>1, 'img'=>1, 'input'=>1, 'isindex'=>1, 'keygen'=>1, 'link'=>1, 'meta'=>1, 'param'=>1, 'source'=>1, 'track'=>1, 'wbr'=>1); // Empty
    193. 

  193. $cF = array('a'=>1, 'article'=>1, 'aside'=>1, 'audio'=>1, 'button'=>1, 'canvas'=>1, 'del'=>1, 'details'=>1, 'div'=>1, 'dd'=>1, 'fieldset'=>1, 'figure'=>1, 'footer'=>1, 'header'=>1, 'iframe'=>1, 'ins'=>1, 'li'=>1, 'main'=>1, 'menu'=>1, 'nav'=>1, 'noscript'=>1, 'object'=>1, 'section'=>1, 'style'=>1, 'td'=>1, 'th'=>1, 'video'=>1); // Flow; later context-wise dynamic move of ins & del to $cI
    194. 

  194. $cI = array('abbr'=>1, 'acronym'=>1, 'address'=>1, 'b'=>1, 'bdi'=>1, 'bdo'=>1, 'big'=>1, 'caption'=>1, 'cite'=>1, 'code'=>1, 'data'=>1, 'datalist'=>1, 'dfn'=>1, 'dt'=>1, 'em'=>1, 'figcaption'=>1, 'font'=>1, 'h1'=>1, 'h2'=>1, 'h3'=>1, 'h4'=>1, 'h5'=>1, 'h6'=>1, 'hgroup'=>1, 'i'=>1, 'kbd'=>1, 'label'=>1, 'legend'=>1, 'mark'=>1, 'meter'=>1, 'output'=>1, 'p'=>1, 'pre'=>1, 'progress'=>1, 'q'=>1, 'rb'=>1, 'rt'=>1, 's'=>1, 'samp'=>1, 'small'=>1, 'span'=>1, 'strike'=>1, 'strong'=>1, 'sub'=>1, 'summary'=>1, 'sup'=>1, 'time'=>1, 'tt'=>1, 'u'=>1, 'var'=>1); // Inline
    195. 

  195. $cN = array('a'=>array('a'=>1, 'address'=>1, 'button'=>1, 'details'=>1, 'embed'=>1, 'keygen'=>1, 'label'=>1, 'select'=>1, 'textarea'=>1), 'address'=>array('address'=>1, 'article'=>1, 'aside'=>1, 'header'=>1, 'keygen'=>1, 'footer'=>1, 'nav'=>1, 'section'=>1), 'button'=>array('a'=>1, 'address'=>1, 'button'=>1, 'details'=>1, 'embed'=>1, 'fieldset'=>1, 'form'=>1, 'iframe'=>1, 'input'=>1, 'keygen'=>1, 'label'=>1, 'select'=>1, 'textarea'=>1), 'fieldset'=>array('fieldset'=>1), 'footer'=>array('header'=>1, 'footer'=>1), 'form'=>array('form'=>1), 'header'=>array('header'=>1, 'footer'=>1), 'label'=>array('label'=>1), 'main'=>array('main'=>1), 'meter'=>array('meter'=>1), 'noscript'=>array('script'=>1), 'pre'=>array('big'=>1, 'font'=>1, 'img'=>1, 'object'=>1, 'script'=>1, 'small'=>1, 'sub'=>1, 'sup'=>1), 'progress'=>array('progress'=>1), 'rb'=>array('ruby'=>1), 'rt'=>array('ruby'=>1), 'time'=>array('time'=>1), ); // Illegal
    196. 

  196. $cN2 = array_keys($cN);
    197. 

  197. $cS = array('colgroup'=>array('col'=>1), 'datalist'=>array('option'=>1), 'dir'=>array('li'=>1), 'dl'=>array('dd'=>1, 'dt'=>1), 'hgroup'=>array('h1'=>1, 'h2'=>1, 'h3'=>1, 'h4'=>1, 'h5'=>1, 'h6'=>1), 'menu'=>array('li'=>1), 'ol'=>array('li'=>1), 'optgroup'=>array('option'=>1), 'option'=>array('#pcdata'=>1), 'rbc'=>array('rb'=>1), 'rp'=>array('#pcdata'=>1), 'rtc'=>array('rt'=>1), 'ruby'=>array('rb'=>1, 'rbc'=>1, 'rp'=>1, 'rt'=>1, 'rtc'=>1), 'select'=>array('optgroup'=>1, 'option'=>1), 'script'=>array('#pcdata'=>1), 'table'=>array('caption'=>1, 'col'=>1, 'colgroup'=>1, 'tfoot'=>1, 'tbody'=>1, 'tr'=>1, 'thead'=>1), 'tbody'=>array('tr'=>1), 'tfoot'=>array('tr'=>1), 'textarea'=>array('#pcdata'=>1), 'thead'=>array('tr'=>1), 'tr'=>array('td'=>1, 'th'=>1), 'ul'=>array('li'=>1)); // Specific - immediate parent-child
    198. 

  198. if($GLOBALS['C']['direct_list_nest']){$cS['ol'] = $cS['ul'] = $cS['menu'] += array('menu'=>1, 'ol'=>1, 'ul'=>1);}
    199. 

  199. $cO = array('address'=>array('p'=>1), 'applet'=>array('param'=>1), 'audio'=>array('source'=>1, 'track'=>1), 'blockquote'=>array('script'=>1), 'details'=>array('summary'=>1), 'fieldset'=>array('legend'=>1, '#pcdata'=>1),  'figure'=>array('figcaption'=>1),'form'=>array('script'=>1), 'map'=>array('area'=>1), 'object'=>array('param'=>1, 'embed'=>1), 'video'=>array('source'=>1, 'track'=>1)); // Other
    200. 

  200. $cT = array('colgroup'=>1, 'dd'=>1, 'dt'=>1, 'li'=>1, 'option'=>1, 'p'=>1, 'td'=>1, 'tfoot'=>1, 'th'=>1, 'thead'=>1, 'tr'=>1); // Omitable closing
    201. 

  201. // block/inline type; a/ins/del both type; #pcdata: text
    202. 

  202. $eB = array('a'=>1, 'address'=>1, 'article'=>1, 'aside'=>1, 'blockquote'=>1, 'center'=>1, 'del'=>1, 'details'=>1, 'dir'=>1, 'dl'=>1, 'div'=>1, 'fieldset'=>1, 'figure'=>1, 'footer'=>1, 'form'=>1, 'ins'=>1, 'h1'=>1, 'h2'=>1, 'h3'=>1, 'h4'=>1, 'h5'=>1, 'h6'=>1, 'header'=>1, 'hr'=>1, 'isindex'=>1, 'main'=>1, 'menu'=>1, 'nav'=>1, 'noscript'=>1, 'ol'=>1, 'p'=>1, 'pre'=>1, 'section'=>1, 'style'=>1, 'table'=>1, 'ul'=>1);
    203. 

  203. $eI = array('#pcdata'=>1, 'a'=>1, 'abbr'=>1, 'acronym'=>1, 'applet'=>1, 'audio'=>1, 'b'=>1, 'bdi'=>1, 'bdo'=>1, 'big'=>1, 'br'=>1, 'button'=>1, 'canvas'=>1, 'cite'=>1, 'code'=>1, 'command'=>1, 'data'=>1, 'datalist'=>1, 'del'=>1, 'dfn'=>1, 'em'=>1, 'embed'=>1, 'figcaption'=>1, 'font'=>1, 'i'=>1, 'iframe'=>1, 'img'=>1, 'input'=>1, 'ins'=>1, 'kbd'=>1, 'label'=>1, 'link'=>1, 'map'=>1, 'mark'=>1, 'meta'=>1, 'meter'=>1, 'object'=>1, 'output'=>1, 'progress'=>1, 'q'=>1, 'ruby'=>1, 's'=>1, 'samp'=>1, 'select'=>1, 'script'=>1, 'small'=>1, 'span'=>1, 'strike'=>1, 'strong'=>1, 'sub'=>1, 'summary'=>1, 'sup'=>1, 'textarea'=>1, 'time'=>1, 'tt'=>1, 'u'=>1, 'var'=>1, 'video'=>1, 'wbr'=>1);
    204. 

  204. $eN = array('a'=>1, 'address'=>1, 'article'=>1, 'aside'=>1, 'big'=>1, 'button'=>1, 'details'=>1, 'embed'=>1, 'fieldset'=>1, 'font'=>1, 'footer'=>1, 'form'=>1, 'header'=>1, 'iframe'=>1, 'img'=>1, 'input'=>1, 'keygen'=>1, 'label'=>1, 'meter'=>1, 'nav'=>1, 'object'=>1, 'progress'=>1, 'ruby'=>1, 'script'=>1, 'select'=>1, 'small'=>1, 'sub'=>1, 'sup'=>1, 'textarea'=>1, 'time'=>1); // Exclude from specific ele; $cN values
    205. 

  205. $eO = array('area'=>1, 'caption'=>1, 'col'=>1, 'colgroup'=>1, 'command'=>1, 'dd'=>1, 'dt'=>1, 'hgroup'=>1, 'keygen'=>1, 'legend'=>1, 'li'=>1, 'optgroup'=>1, 'option'=>1, 'param'=>1, 'rb'=>1, 'rbc'=>1, 'rp'=>1, 'rt'=>1, 'rtc'=>1, 'script'=>1, 'source'=>1, 'tbody'=>1, 'td'=>1, 'tfoot'=>1, 'thead'=>1, 'th'=>1, 'tr'=>1, 'track'=>1); // Missing in $eB & $eI
    206. 

  206. $eF = $eB + $eI;
    207. 

  207. 

  208. // $in sets allowed child
    209. 

  209. $in = ((isset($eF[$in]) && $in != '#pcdata') or isset($eO[$in])) ? $in : 'div';
    210. 

  210. if(isset($cE[$in])){
    211. 

  211.  return (!$do ? '' : str_replace(array('<', '>'), array('&lt;', '&gt;'), $t));
    212. 

  212. }
    213. 

  213. if(isset($cS[$in])){$inOk = $cS[$in];}
    214. 

  214. elseif(isset($cI[$in])){$inOk = $eI; $cI['del'] = 1; $cI['ins'] = 1;}
    215. 

  215. elseif(isset($cF[$in])){$inOk = $eF; unset($cI['del'], $cI['ins']);}
    216. 

  216. elseif(isset($cB[$in])){$inOk = $eB; unset($cI['del'], $cI['ins']);}
    217. 

  217. if(isset($cO[$in])){$inOk = $inOk + $cO[$in];}
    218. 

  218. if(isset($cN[$in])){$inOk = array_diff_assoc($inOk, $cN[$in]);}
    219. 

  219. 

  220. $t = explode('<', $t);
    221. 

  221. $ok = $q = array(); // $q seq list of open non-empty ele
    222. 

  222. ob_start();
    223. 

  223. 

  224. for($i=-1, $ci=count($t); ++$i<$ci;){
    225. 

  225.  // allowed $ok in parent $p
    226. 

  226.  if($ql = count($q)){
    227. 

  227.   $p = array_pop($q);
    228. 

  228.   $q[] = $p;
    229. 

  229.   if(isset($cS[$p])){$ok = $cS[$p];}
    230. 

  230.   elseif(isset($cI[$p])){$ok = $eI; $cI['del'] = 1; $cI['ins'] = 1;}
    231. 

  231.   elseif(isset($cF[$p])){$ok = $eF; unset($cI['del'], $cI['ins']);}
    232. 

  232.   elseif(isset($cB[$p])){$ok = $eB; unset($cI['del'], $cI['ins']);}
    233. 

  233.   if(isset($cO[$p])){$ok = $ok + $cO[$p];}
    234. 

  234.   if(isset($cN[$p])){$ok = array_diff_assoc($ok, $cN[$p]);}
    235. 

  235.  }else{$ok = $inOk; unset($cI['del'], $cI['ins']);}
    236. 

  236.  // bad tags, & ele content
    237. 

  237.  if(isset($e) && ($do == 1 or (isset($ok['#pcdata']) && ($do == 3 or $do == 5)))){
    238. 

  238.   echo '&lt;', $s, $e, $a, '&gt;';
    239. 

  239.  }
    240. 

  240.  if(isset($x[0])){
    241. 

  241.   if(strlen(trim($x)) && (($ql && isset($cB[$p])) or (isset($cB[$in]) && !$ql))){
    242. 

  242.    echo '<div>', $x, '</div>';
    243. 

  243.   }
    244. 

  244.   elseif($do < 3 or isset($ok['#pcdata'])){echo $x;}
    245. 

  245.   elseif(strpos($x, "\x02\x04")){
    246. 

  246.    foreach(preg_split('`(\x01\x02[^\x01\x02]+\x02\x01)`', $x, -1, PREG_SPLIT_DELIM_CAPTURE | PREG_SPLIT_NO_EMPTY) as $v){
    247. 

  247.     echo (substr($v, 0, 2) == "\x01\x02" ? $v : ($do > 4 ? preg_replace('`\S`', '', $v) : ''));
    248. 

  248.    }
    249. 

  249.   }elseif($do > 4){echo preg_replace('`\S`', '', $x);}
    250. 

  250.  }
    251. 

  251.  // get markup
    252. 

  252.  if(!preg_match('`^(/?)([a-z1-6]+)([^>]*)>(.*)`sm', $t[$i], $r)){$x = $t[$i]; continue;}
    253. 

  253.  $s = null; $e = null; $a = null; $x = null; list($all, $s, $e, $a, $x) = $r;
    254. 

  254.  // close tag
    255. 

  255.  if($s){
    256. 

  256.   if(isset($cE[$e]) or !in_array($e, $q)){continue;} // Empty/unopen
    257. 

  257.   if($p == $e){array_pop($q); echo '</', $e, '>'; unset($e); continue;} // Last open
    258. 

  258.   $add = ''; // Nesting - close open tags that need to be
    259. 

  259.   for($j=-1, $cj=count($q); ++$j<$cj;){
    260. 

  260.    if(($d = array_pop($q)) == $e){break;}
    261. 

  261.    else{$add .= "</{$d}>";}
    262. 

  262.   }
    263. 

  263.   echo $add, '</', $e, '>'; unset($e); continue;
    264. 

  264.  }
    265. 

  265.  // open tag
    266. 

  266.  // $cB ele needs $eB ele as child
    267. 

  267.  if(isset($cB[$e]) && strlen(trim($x))){
    268. 

  268.   $t[$i] = "{$e}{$a}>";
    269. 

  269.   array_splice($t, $i+1, 0, 'div>'. $x); unset($e, $x); ++$ci; --$i; continue;
    270. 

  270.  }
    271. 

  271.  if((($ql && isset($cB[$p])) or (isset($cB[$in]) && !$ql)) && !isset($eB[$e]) && !isset($ok[$e])){
    272. 

  272.   array_splice($t, $i, 0, 'div>'); unset($e, $x); ++$ci; --$i; continue;
    273. 

  273.  }
    274. 

  274.  // if no open ele, $in = parent; mostly immediate parent-child relation should hold
    275. 

  275.  if(!$ql or !isset($eN[$e]) or !array_intersect($q, $cN2)){
    276. 

  276.   if(!isset($ok[$e])){
    277. 

  277.    if($ql && isset($cT[$p])){echo '</', array_pop($q), '>'; unset($e, $x); --$i;}
    278. 

  278.    continue;
    279. 

  279.   }
    280. 

  280.   if(!isset($cE[$e])){$q[] = $e;}
    281. 

  281.   echo '<', $e, $a, '>'; unset($e); continue;
    282. 

  282.  }
    283. 

  283.  // specific parent-child
    284. 

  284.  if(isset($cS[$p][$e])){
    285. 

  285.   if(!isset($cE[$e])){$q[] = $e;}
    286. 

  286.   echo '<', $e, $a, '>'; unset($e); continue;
    287. 

  287.  }
    288. 

  288.  // nesting
    289. 

  289.  $add = '';
    290. 

  290.  $q2 = array();
    291. 

  291.  for($k=-1, $kc=count($q); ++$k<$kc;){
    292. 

  292.   $d = $q[$k];
    293. 

  293.   $ok2 = array();
    294. 

  294.   if(isset($cS[$d])){$q2[] = $d; continue;}
    295. 

  295.   $ok2 = isset($cI[$d]) ? $eI : $eF;
    296. 

  296.   if(isset($cO[$d])){$ok2 = $ok2 + $cO[$d];}
    297. 

  297.   if(isset($cN[$d])){$ok2 = array_diff_assoc($ok2, $cN[$d]);}
    298. 

  298.   if(!isset($ok2[$e])){
    299. 

  299.    if(!$k && !isset($inOk[$e])){continue 2;}
    300. 

  300.    $add = "</{$d}>";
    301. 

  301.    for(;++$k<$kc;){$add = "</{$q[$k]}>{$add}";}
    302. 

  302.    break;
    303. 

  303.   }
    304. 

  304.   else{$q2[] = $d;}
    305. 

  305.  }
    306. 

  306.  $q = $q2;
    307. 

  307.  if(!isset($cE[$e])){$q[] = $e;}
    308. 

  308.  echo $add, '<', $e, $a, '>'; unset($e); continue;
    309. 

  309. }
    310. 

  310. 

  311. // end
    312. 

  312. if($ql = count($q)){
    313. 

  313.  $p = array_pop($q);
    314. 

  314.  $q[] = $p;
    315. 

  315.  if(isset($cS[$p])){$ok = $cS[$p];}
    316. 

  316.  elseif(isset($cI[$p])){$ok = $eI; $cI['del'] = 1; $cI['ins'] = 1;}
    317. 

  317.  elseif(isset($cF[$p])){$ok = $eF; unset($cI['del'], $cI['ins']);}
    318. 

  318.  elseif(isset($cB[$p])){$ok = $eB; unset($cI['del'], $cI['ins']);}
    319. 

  319.  if(isset($cO[$p])){$ok = $ok + $cO[$p];}
    320. 

  320.  if(isset($cN[$p])){$ok = array_diff_assoc($ok, $cN[$p]);}
    321. 

  321. }else{$ok = $inOk; unset($cI['del'], $cI['ins']);}
    322. 

  322. if(isset($e) && ($do == 1 or (isset($ok['#pcdata']) && ($do == 3 or $do == 5)))){
    323. 

  323.  echo '&lt;', $s, $e, $a, '&gt;';
    324. 

  324. }
    325. 

  325. if(isset($x[0])){
    326. 

  326.  if(strlen(trim($x)) && (($ql && isset($cB[$p])) or (isset($cB[$in]) && !$ql))){
    327. 

  327.   echo '<div>', $x, '</div>';
    328. 

  328.  }
    329. 

  329.  elseif($do < 3 or isset($ok['#pcdata'])){echo $x;}
    330. 

  330.  elseif(strpos($x, "\x02\x04")){
    331. 

  331.   foreach(preg_split('`(\x01\x02[^\x01\x02]+\x02\x01)`', $x, -1, PREG_SPLIT_DELIM_CAPTURE | PREG_SPLIT_NO_EMPTY) as $v){
    332. 

  332.    echo (substr($v, 0, 2) == "\x01\x02" ? $v : ($do > 4 ? preg_replace('`\S`', '', $v) : ''));
    333. 

  333.   }
    334. 

  334.  }elseif($do > 4){echo preg_replace('`\S`', '', $x);}
    335. 

  335. }
    336. 

  336. while(!empty($q) && ($e = array_pop($q))){echo '</', $e, '>';}
    337. 

  337. $o = ob_get_contents();
    338. 

  338. ob_end_clean();
    339. 

  339. return $o;
    340. 

  340. }
    341. 

  341. 

  342. function hl_cmtcd($t){
    343. 

  343. // comment/CDATA sec handler
    344. 

  344. $t = $t[0];
    345. 

  345. global $C;
    346. 

  346. if(!($v = $C[$n = $t[3] == '-' ? 'comment' : 'cdata'])){return $t;}
    347. 

  347. if($v == 1){return '';}
    348. 

  348. if($n == 'comment' && $v < 4){
    349. 

  349.  if(substr(($t = preg_replace('`--+`', '-', substr($t, 4, -3))), -1) != ' '){$t .= ' ';}
    350. 

  350. }
    351. 

  351. else{$t = substr($t, 1, -1);}
    352. 

  352. $t = $v == 2 ? str_replace(array('&', '<', '>'), array('&amp;', '&lt;', '&gt;'), $t) : $t;
    353. 

  353. return str_replace(array('&', '<', '>'), array("\x03", "\x04", "\x05"), ($n == 'comment' ? "\x01\x02\x04!--$t--\x05\x02\x01" : "\x01\x01\x04$t\x05\x01\x01"));
    354. 

  354. }
    355. 

  355. 

  356. function hl_ent($t){
    357. 

  357. // entitity handler
    358. 

  358. global $C;
    359. 

  359. $t = $t[1];
    360. 

  360. static $U = array('quot'=>1,'amp'=>1,'lt'=>1,'gt'=>1);
    361. 

  361. static $N = array('fnof'=>'402', 'Alpha'=>'913', 'Beta'=>'914', 'Gamma'=>'915', 'Delta'=>'916', 'Epsilon'=>'917', 'Zeta'=>'918', 'Eta'=>'919', 'Theta'=>'920', 'Iota'=>'921', 'Kappa'=>'922', 'Lambda'=>'923', 'Mu'=>'924', 'Nu'=>'925', 'Xi'=>'926', 'Omicron'=>'927', 'Pi'=>'928', 'Rho'=>'929', 'Sigma'=>'931', 'Tau'=>'932', 'Upsilon'=>'933', 'Phi'=>'934', 'Chi'=>'935', 'Psi'=>'936', 'Omega'=>'937', 'alpha'=>'945', 'beta'=>'946', 'gamma'=>'947', 'delta'=>'948', 'epsilon'=>'949', 'zeta'=>'950', 'eta'=>'951', 'theta'=>'952', 'iota'=>'953', 'kappa'=>'954', 'lambda'=>'955', 'mu'=>'956', 'nu'=>'957', 'xi'=>'958', 'omicron'=>'959', 'pi'=>'960', 'rho'=>'961', 'sigmaf'=>'962', 'sigma'=>'963', 'tau'=>'964', 'upsilon'=>'965', 'phi'=>'966', 'chi'=>'967', 'psi'=>'968', 'omega'=>'969', 'thetasym'=>'977', 'upsih'=>'978', 'piv'=>'982', 'bull'=>'8226', 'hellip'=>'8230', 'prime'=>'8242', 'Prime'=>'8243', 'oline'=>'8254', 'frasl'=>'8260', 'weierp'=>'8472', 'image'=>'8465', 'real'=>'8476', 'trade'=>'8482', 'alefsym'=>'8501', 'larr'=>'8592', 'uarr'=>'8593', 'rarr'=>'8594', 'darr'=>'8595', 'harr'=>'8596', 'crarr'=>'8629', 'lArr'=>'8656', 'uArr'=>'8657', 'rArr'=>'8658', 'dArr'=>'8659', 'hArr'=>'8660', 'forall'=>'8704', 'part'=>'8706', 'exist'=>'8707', 'empty'=>'8709', 'nabla'=>'8711', 'isin'=>'8712', 'notin'=>'8713', 'ni'=>'8715', 'prod'=>'8719', 'sum'=>'8721', 'minus'=>'8722', 'lowast'=>'8727', 'radic'=>'8730', 'prop'=>'8733', 'infin'=>'8734', 'ang'=>'8736', 'and'=>'8743', 'or'=>'8744', 'cap'=>'8745', 'cup'=>'8746', 'int'=>'8747', 'there4'=>'8756', 'sim'=>'8764', 'cong'=>'8773', 'asymp'=>'8776', 'ne'=>'8800', 'equiv'=>'8801', 'le'=>'8804', 'ge'=>'8805', 'sub'=>'8834', 'sup'=>'8835', 'nsub'=>'8836', 'sube'=>'8838', 'supe'=>'8839', 'oplus'=>'8853', 'otimes'=>'8855', 'perp'=>'8869', 'sdot'=>'8901', 'lceil'=>'8968', 'rceil'=>'8969', 'lfloor'=>'8970', 'rfloor'=>'8971', 'lang'=>'9001', 'rang'=>'9002', 'loz'=>'9674', 'spades'=>'9824', 'clubs'=>'9827', 'hearts'=>'9829', 'diams'=>'9830', 'apos'=>'39',  'OElig'=>'338', 'oelig'=>'339', 'Scaron'=>'352', 'scaron'=>'353', 'Yuml'=>'376', 'circ'=>'710', 'tilde'=>'732', 'ensp'=>'8194', 'emsp'=>'8195', 'thinsp'=>'8201', 'zwnj'=>'8204', 'zwj'=>'8205', 'lrm'=>'8206', 'rlm'=>'8207', 'ndash'=>'8211', 'mdash'=>'8212', 'lsquo'=>'8216', 'rsquo'=>'8217', 'sbquo'=>'8218', 'ldquo'=>'8220', 'rdquo'=>'8221', 'bdquo'=>'8222', 'dagger'=>'8224', 'Dagger'=>'8225', 'permil'=>'8240', 'lsaquo'=>'8249', 'rsaquo'=>'8250', 'euro'=>'8364', 'nbsp'=>'160', 'iexcl'=>'161', 'cent'=>'162', 'pound'=>'163', 'curren'=>'164', 'yen'=>'165', 'brvbar'=>'166', 'sect'=>'167', 'uml'=>'168', 'copy'=>'169', 'ordf'=>'170', 'laquo'=>'171', 'not'=>'172', 'shy'=>'173', 'reg'=>'174', 'macr'=>'175', 'deg'=>'176', 'plusmn'=>'177', 'sup2'=>'178', 'sup3'=>'179', 'acute'=>'180', 'micro'=>'181', 'para'=>'182', 'middot'=>'183', 'cedil'=>'184', 'sup1'=>'185', 'ordm'=>'186', 'raquo'=>'187', 'frac14'=>'188', 'frac12'=>'189', 'frac34'=>'190', 'iquest'=>'191', 'Agrave'=>'192', 'Aacute'=>'193', 'Acirc'=>'194', 'Atilde'=>'195', 'Auml'=>'196', 'Aring'=>'197', 'AElig'=>'198', 'Ccedil'=>'199', 'Egrave'=>'200', 'Eacute'=>'201', 'Ecirc'=>'202', 'Euml'=>'203', 'Igrave'=>'204', 'Iacute'=>'205', 'Icirc'=>'206', 'Iuml'=>'207', 'ETH'=>'208', 'Ntilde'=>'209', 'Ograve'=>'210', 'Oacute'=>'211', 'Ocirc'=>'212', 'Otilde'=>'213', 'Ouml'=>'214', 'times'=>'215', 'Oslash'=>'216', 'Ugrave'=>'217', 'Uacute'=>'218', 'Ucirc'=>'219', 'Uuml'=>'220', 'Yacute'=>'221', 'THORN'=>'222', 'szlig'=>'223', 'agrave'=>'224', 'aacute'=>'225', 'acirc'=>'226', 'atilde'=>'227', 'auml'=>'228', 'aring'=>'229', 'aelig'=>'230', 'ccedil'=>'231', 'egrave'=>'232', 'eacute'=>'233', 'ecirc'=>'234', 'euml'=>'235', 'igrave'=>'236', 'iacute'=>'237', 'icirc'=>'238', 'iuml'=>'239', 'eth'=>'240', 'ntilde'=>'241', 'ograve'=>'242', 'oacute'=>'243', 'ocirc'=>'244', 'otilde'=>'245', 'ouml'=>'246', 'divide'=>'247', 'oslash'=>'248', 'ugrave'=>'249', 'uacute'=>'250', 'ucirc'=>'251', 'uuml'=>'252', 'yacute'=>'253', 'thorn'=>'254', 'yuml'=>'255');
    362. 

  362. if($t[0] != '#'){
    363. 

  363.  return ($C['and_mark'] ? "\x06" : '&'). (isset($U[$t]) ? $t : (isset($N[$t]) ? (!$C['named_entity'] ? '#'. ($C['hexdec_entity'] > 1 ? 'x'. dechex($N[$t]) : $N[$t]) : $t) : 'amp;'. $t)). ';';
    364. 

  364. }
    365. 

  365. if(($n = ctype_digit($t = substr($t, 1)) ? intval($t) : hexdec(substr($t, 1))) < 9 or ($n > 13 && $n < 32) or $n == 11 or $n == 12 or ($n > 126 && $n < 160 && $n != 133) or ($n > 55295 && ($n < 57344 or ($n > 64975 && $n < 64992) or $n == 65534 or $n == 65535 or $n > 1114111))){
    366. 

  366.  return ($C['and_mark'] ? "\x06" : '&'). "amp;#{$t};";
    367. 

  367. }
    368. 

  368. return ($C['and_mark'] ? "\x06" : '&'). '#'. (((ctype_digit($t) && $C['hexdec_entity'] < 2) or !$C['hexdec_entity']) ? $n : 'x'. dechex($n)). ';';
    369. 

  369. }
    370. 

  370. 

  371. function hl_prot($p, $c=null){
    372. 

  372. // check URL scheme
    373. 

  373. global $C;
    374. 

  374. $b = $a = '';
    375. 

  375. if($c == null){$c = 'style'; $b = $p[1]; $a = $p[3]; $p = trim($p[2]);}
    376. 

  376. $c = isset($C['schemes'][$c]) ? $C['schemes'][$c] : $C['schemes']['*'];
    377. 

  377. static $d = 'denied:';
    378. 

  378. if(isset($c['!']) && substr($p, 0, 7) != $d){$p = "$d$p";}
    379. 

  379. if(isset($c['*']) or !strcspn($p, '#?;') or (substr($p, 0, 7) == $d)){return "{$b}{$p}{$a}";} // All ok, frag, query, param
    380. 

  380. if(preg_match('`^([^:?[@!$()*,=/\'\]]+?)(:|&#(58|x3a);|%3a|\\\\0{0,4}3a).`i', $p, $m) && !isset($c[strtolower($m[1])])){ // Denied prot
    381. 

  381.  return "{$b}{$d}{$p}{$a}";
    382. 

  382. }
    383. 

  383. if($C['abs_url']){
    384. 

  384.  if($C['abs_url'] == -1 && strpos($p, $C['base_url']) === 0){ // Make url rel
    385. 

  385.   $p = substr($p, strlen($C['base_url']));
    386. 

  386.  }elseif(empty($m[1])){ // Make URL abs
    387. 

  387.   if(substr($p, 0, 2) == '//'){$p = substr($C['base_url'], 0, strpos($C['base_url'], ':')+1). $p;}
    388. 

  388.   elseif($p[0] == '/'){$p = preg_replace('`(^.+?://[^/]+)(.*)`', '$1', $C['base_url']). $p;}
    389. 

  389.   elseif(strcspn($p, './')){$p = $C['base_url']. $p;}
    390. 

  390.   else{
    391. 

  391.    preg_match('`^([a-zA-Z\d\-+.]+://[^/]+)(.*)`', $C['base_url'], $m);
    392. 

  392.    $p = preg_replace('`(?<=/)\./`', '', $m[2]. $p);
    393. 

  393.    while(preg_match('`(?<=/)([^/]{3,}|[^/.]+?|\.[^/.]|[^/.]\.)/\.\./`', $p)){
    394. 

  394.     $p = preg_replace('`(?<=/)([^/]{3,}|[^/.]+?|\.[^/.]|[^/.]\.)/\.\./`', '', $p);
    395. 

  395.    }
    396. 

  396.    $p = $m[1]. $p;
    397. 

  397.   }
    398. 

  398.  }
    399. 

  399. }
    400. 

  400. return "{$b}{$p}{$a}";
    401. 

  401. }
    402. 

  402. 

  403. function hl_regex($p){
    404. 

  404. // check regex
    405. 

  405. if(empty($p)){return 0;}
    406. 

  406. if($v = function_exists('error_clear_last') && function_exists('error_get_last')){error_clear_last();}
    407. 

  407. else{
    408. 

  408.  if($t = ini_get('track_errors')){$o = isset($php_errormsg) ? $php_errormsg : null;}
    409. 

  409.  else{ini_set('track_errors', 1);}
    410. 

  410.  unset($php_errormsg);
    411. 

  411. }
    412. 

  412. if(($d = ini_get('display_errors'))){ini_set('display_errors', 0);}
    413. 

  413. preg_match($p, '');
    414. 

  414. if($v){$r = error_get_last() == null ? 1 : 0; }
    415. 

  415. else{
    416. 

  416.  $r = isset($php_errormsg) ? 0 : 1;
    417. 

  417.  if($t){$php_errormsg = isset($o) ? $o : null;}
    418. 

  418.  else{ini_set('track_errors', 0);}
    419. 

  419. }
    420. 

  420. if($d){ini_set('display_errors', 1);}
    421. 

  421. return $r;
    422. 

  422. }
    423. 

  423. 

  424. function hl_spec($t){
    425. 

  425. // final $spec
    426. 

  426. $s = array();
    427. 

  427. if(!function_exists('hl_aux1')){function hl_aux1($m){
    428. 

  428.  return substr(str_replace(array(";", "|", "~", " ", ",", "/", "(", ")", '`"'), array("\x01", "\x02", "\x03", "\x04", "\x05", "\x06", "\x07", "\x08", '"'), $m[0]), 1, -1);
    429. 

  429. }}
    430. 

  430. $t = str_replace(array("\t", "\r", "\n", ' '), '', preg_replace_callback('/"(?>(`.|[^"])*)"/sm', 'hl_aux1', trim($t)));
    431. 

  431. for($i = count(($t = explode(';', $t))); --$i>=0;){
    432. 

  432.  $w = $t[$i];
    433. 

  433.  if(empty($w) or ($e = strpos($w, '=')) === false or !strlen(($a =  substr($w, $e+1)))){continue;}
    434. 

  434.  $y = $n = array();
    435. 

  435.  foreach(explode(',', $a) as $v){
    436. 

  436.   if(!preg_match('`^([a-z:\-\*]+)(?:\((.*?)\))?`i', $v, $m)){continue;}
    437. 

  437.   if(($x = strtolower($m[1])) == '-*'){$n['*'] = 1; continue;}
    438. 

  438.   if($x[0] == '-'){$n[substr($x, 1)] = 1; continue;}
    439. 

  439.   if(!isset($m[2])){$y[$x] = 1; continue;}
    440. 

  440.   foreach(explode('/', $m[2]) as $m){
    441. 

  441.    if(empty($m) or ($p = strpos($m, '=')) == 0 or $p < 5){$y[$x] = 1; continue;}
    442. 

  442.    $y[$x][strtolower(substr($m, 0, $p))] = str_replace(array("\x01", "\x02", "\x03", "\x04", "\x05", "\x06", "\x07", "\x08"), array(";", "|", "~", " ", ",", "/", "(", ")"), substr($m, $p+1));
    443. 

  443.   }
    444. 

  444.   if(isset($y[$x]['match']) && !hl_regex($y[$x]['match'])){unset($y[$x]['match']);}
    445. 

  445.   if(isset($y[$x]['nomatch']) && !hl_regex($y[$x]['nomatch'])){unset($y[$x]['nomatch']);}
    446. 

  446.  }
    447. 

  447.  if(!count($y) && !count($n)){continue;}
    448. 

  448.  foreach(explode(',', substr($w, 0, $e)) as $v){
    449. 

  449.   if(!strlen(($v = strtolower($v)))){continue;}
    450. 

  450.   if(count($y)){if(!isset($s[$v])){$s[$v] = $y;} else{$s[$v] = array_merge($s[$v], $y);}}
    451. 

  451.   if(count($n)){if(!isset($s[$v]['n'])){$s[$v]['n'] = $n;} else{$s[$v]['n'] = array_merge($s[$v]['n'], $n);}}
    452. 

  452.  }
    453. 

  453. }
    454. 

  454. return $s;
    455. 

  455. }
    456. 

  456. 

  457. function hl_tag($t){
    458. 

  458. // tag/attribute handler
    459. 

  459. global $C;
    460. 

  460. $t = $t[0];
    461. 

  461. // invalid < >
    462. 

  462. if($t == '< '){return '&lt; ';}
    463. 

  463. if($t == '>'){return '&gt;';}
    464. 

  464. if(!preg_match('`^<(/?)([a-zA-Z][a-zA-Z1-6]*)([^>]*?)\s?>$`m', $t, $m)){
    465. 

  465.  return str_replace(array('<', '>'), array('&lt;', '&gt;'), $t);
    466. 

  466. }elseif(!isset($C['elements'][($e = strtolower($m[2]))])){
    467. 

  467.  return (($C['keep_bad']%2) ? str_replace(array('<', '>'), array('&lt;', '&gt;'), $t) : '');
    468. 

  468. }
    469. 

  469. // attr string
    470. 

  470. $a = str_replace(array("\n", "\r", "\t"), ' ', trim($m[3]));
    471. 

  471. // tag transform
    472. 

  472. static $eD = array('acronym'=>1, 'applet'=>1, 'big'=>1, 'center'=>1, 'dir'=>1, 'font'=>1, 'isindex'=>1, 's'=>1, 'strike'=>1, 'tt'=>1); // Deprecated
    473. 

  473. if($C['make_tag_strict'] && isset($eD[$e])){
    474. 

  474.  $trt = hl_tag2($e, $a, $C['make_tag_strict']);
    475. 

  475.  if(!$e){return (($C['keep_bad']%2) ? str_replace(array('<', '>'), array('&lt;', '&gt;'), $t) : '');}
    476. 

  476. }
    477. 

  477. // close tag
    478. 

  478. static $eE = array('area'=>1, 'br'=>1, 'col'=>1, 'command'=>1, 'embed'=>1, 'hr'=>1, 'img'=>1, 'input'=>1, 'isindex'=>1, 'keygen'=>1, 'link'=>1, 'meta'=>1, 'param'=>1, 'source'=>1, 'track'=>1, 'wbr'=>1); // Empty ele
    479. 

  479. if(!empty($m[1])){
    480. 

  480.  return (!isset($eE[$e]) ? (empty($C['hook_tag']) ? "</$e>" : $C['hook_tag']($e)) : (($C['keep_bad'])%2 ? str_replace(array('<', '>'), array('&lt;', '&gt;'), $t) : ''));
    481. 

  481. }
    482. 

  482. 

  483. // open tag & attr
    484. 

  484. static $aN = array('abbr'=>array('td'=>1, 'th'=>1), 'accept'=>array('form'=>1, 'input'=>1), 'accept-charset'=>array('form'=>1), 'action'=>array('form'=>1), 'align'=>array('applet'=>1, 'caption'=>1, 'col'=>1, 'colgroup'=>1, 'div'=>1, 'embed'=>1, 'h1'=>1, 'h2'=>1, 'h3'=>1, 'h4'=>1, 'h5'=>1, 'h6'=>1, 'hr'=>1, 'iframe'=>1, 'img'=>1, 'input'=>1, 'legend'=>1, 'object'=>1, 'p'=>1, 'table'=>1, 'tbody'=>1, 'td'=>1, 'tfoot'=>1, 'th'=>1, 'thead'=>1, 'tr'=>1), 'allowfullscreen'=>array('iframe'=>1), 'alt'=>array('applet'=>1, 'area'=>1, 'img'=>1, 'input'=>1), 'archive'=>array('applet'=>1, 'object'=>1), 'async'=>array('script'=>1), 'autocomplete'=>array('form'=>1, 'input'=>1), 'autofocus'=>array('button'=>1, 'input'=>1, 'keygen'=>1, 'select'=>1, 'textarea'=>1), 'autoplay'=>array('audio'=>1, 'video'=>1), 'axis'=>array('td'=>1, 'th'=>1), 'bgcolor'=>array('embed'=>1, 'table'=>1, 'td'=>1, 'th'=>1, 'tr'=>1), 'border'=>array('img'=>1, 'object'=>1, 'table'=>1), 'bordercolor'=>array('table'=>1, 'td'=>1, 'tr'=>1), 'cellpadding'=>array('table'=>1), 'cellspacing'=>array('table'=>1), 'challenge'=>array('keygen'=>1), 'char'=>array('col'=>1, 'colgroup'=>1, 'tbody'=>1, 'td'=>1, 'tfoot'=>1, 'th'=>1, 'thead'=>1, 'tr'=>1), 'charoff'=>array('col'=>1, 'colgroup'=>1, 'tbody'=>1, 'td'=>1, 'tfoot'=>1, 'th'=>1, 'thead'=>1, 'tr'=>1), 'charset'=>array('a'=>1, 'script'=>1), 'checked'=>array('command'=>1, 'input'=>1), 'cite'=>array('blockquote'=>1, 'del'=>1, 'ins'=>1, 'q'=>1), 'classid'=>array('object'=>1), 'clear'=>array('br'=>1), 'code'=>array('applet'=>1), 'codebase'=>array('applet'=>1, 'object'=>1), 'codetype'=>array('object'=>1), 'color'=>array('font'=>1), 'cols'=>array('textarea'=>1), 'colspan'=>array('td'=>1, 'th'=>1), 'compact'=>array('dir'=>1, 'dl'=>1, 'menu'=>1, 'ol'=>1, 'ul'=>1), 'content'=>array('meta'=>1), 'controls'=>array('audio'=>1, 'video'=>1), 'coords'=>array('a'=>1, 'area'=>1), 'crossorigin'=>array('img'=>1), 'data'=>array('object'=>1), 'datetime'=>array('del'=>1, 'ins'=>1, 'time'=>1), 'declare'=>array('object'=>1), 'default'=>array('track'=>1), 'defer'=>array('script'=>1), 'dirname'=>array('input'=>1, 'textarea'=>1), 'disabled'=>array('button'=>1, 'command'=>1, 'fieldset'=>1, 'input'=>1, 'keygen'=>1, 'optgroup'=>1, 'option'=>1, 'select'=>1, 'textarea'=>1), 'download'=>array('a'=>1), 'enctype'=>array('form'=>1), 'face'=>array('font'=>1), 'flashvars'=>array('embed'=>1), 'for'=>array('label'=>1, 'output'=>1), 'form'=>array('button'=>1, 'fieldset'=>1, 'input'=>1, 'keygen'=>1, 'label'=>1, 'object'=>1, 'output'=>1, 'select'=>1, 'textarea'=>1), 'formaction'=>array('button'=>1, 'input'=>1), 'formenctype'=>array('button'=>1, 'input'=>1), 'formmethod'=>array('button'=>1, 'input'=>1), 'formnovalidate'=>array('button'=>1, 'input'=>1), 'formtarget'=>array('button'=>1, 'input'=>1), 'frame'=>array('table'=>1), 'frameborder'=>array('iframe'=>1), 'headers'=>array('td'=>1, 'th'=>1), 'height'=>array('applet'=>1, 'canvas'=>1, 'embed'=>1, 'iframe'=>1, 'img'=>1, 'input'=>1, 'object'=>1, 'td'=>1, 'th'=>1, 'video'=>1), 'high'=>array('meter'=>1), 'href'=>array('a'=>1, 'area'=>1, 'link'=>1), 'hreflang'=>array('a'=>1, 'area'=>1, 'link'=>1), 'hspace'=>array('applet'=>1, 'embed'=>1, 'img'=>1, 'object'=>1), 'icon'=>array('command'=>1), 'ismap'=>array('img'=>1, 'input'=>1), 'keyparams'=>array('keygen'=>1), 'keytype'=>array('keygen'=>1), 'kind'=>array('track'=>1), 'label'=>array('command'=>1, 'menu'=>1, 'option'=>1, 'optgroup'=>1, 'track'=>1), 'language'=>array('script'=>1), 'list'=>array('input'=>1), 'longdesc'=>array('img'=>1, 'iframe'=>1), 'loop'=>array('audio'=>1, 'video'=>1), 'low'=>array('meter'=>1), 'marginheight'=>array('iframe'=>1), 'marginwidth'=>array('iframe'=>1), 'max'=>array('input'=>1, 'meter'=>1, 'progress'=>1), 'maxlength'=>array('input'=>1, 'textarea'=>1), 'media'=>array('a'=>1, 'area'=>1, 'link'=>1, 'source'=>1, 'style'=>1), 'mediagroup'=>array('audio'=>1, 'video'=>1), 'method'=>array('form'=>1), 'min'=>array('input'=>1, 'meter'=>1), 'model'=>array('embed'=>1), 'multiple'=>array('input'=>1, 'select'=>1), 'muted'=>array('audio'=>1, 'video'=>1), 'name'=>array('a'=>1, 'applet'=>1, 'button'=>1, 'embed'=>1, 'fieldset'=>1, 'form'=>1, 'iframe'=>1, 'img'=>1, 'input'=>1, 'keygen'=>1, 'map'=>1, 'object'=>1, 'output'=>1, 'param'=>1, 'select'=>1, 'textarea'=>1), 'nohref'=>array('area'=>1), 'noshade'=>array('hr'=>1), 'novalidate'=>array('form'=>1), 'nowrap'=>array('td'=>1, 'th'=>1), 'object'=>array('applet'=>1), 'open'=>array('details'=>1), 'optimum'=>array('meter'=>1), 'pattern'=>array('input'=>1), 'ping'=>array('a'=>1, 'area'=>1), 'placeholder'=>array('input'=>1, 'textarea'=>1), 'pluginspage'=>array('embed'=>1), 'pluginurl'=>array('embed'=>1), 'poster'=>array('video'=>1), 'pqg'=>array('keygen'=>1), 'preload'=>array('audio'=>1, 'video'=>1), 'prompt'=>array('isindex'=>1), 'pubdate'=>array('time'=>1), 'radiogroup'=>array('command'=>1), 'readonly'=>array('input'=>1, 'textarea'=>1), 'rel'=>array('a'=>1, 'area'=>1, 'link'=>1), 'required'=>array('input'=>1, 'select'=>1, 'textarea'=>1), 'rev'=>array('a'=>1), 'reversed'=>array('ol'=>1), 'rows'=>array('textarea'=>1), 'rowspan'=>array('td'=>1, 'th'=>1), 'rules'=>array('table'=>1), 'sandbox'=>array('iframe'=>1), 'scope'=>array('td'=>1, 'th'=>1), 'scoped'=>array('style'=>1), 'scrolling'=>array('iframe'=>1), 'seamless'=>array('iframe'=>1), 'selected'=>array('option'=>1), 'shape'=>array('a'=>1, 'area'=>1), 'size'=>array('font'=>1, 'hr'=>1, 'input'=>1, 'select'=>1), 'sizes'=>array('link'=>1), 'span'=>array('col'=>1, 'colgroup'=>1), 'src'=>array('audio'=>1, 'embed'=>1, 'iframe'=>1, 'img'=>1, 'input'=>1, 'script'=>1, 'source'=>1, 'track'=>1, 'video'=>1), 'srcdoc'=>array('iframe'=>1), 'srclang'=>array('track'=>1), 'srcset'=>array('img'=>1), 'standby'=>array('object'=>1), 'start'=>array('ol'=>1), 'step'=>array('input'=>1), 'summary'=>array('table'=>1), 'target'=>array('a'=>1, 'area'=>1, 'form'=>1), 'type'=>array('a'=>1, 'area'=>1, 'button'=>1, 'command'=>1, 'embed'=>1, 'input'=>1, 'li'=>1, 'link'=>1, 'menu'=>1, 'object'=>1, 'ol'=>1, 'param'=>1, 'script'=>1, 'source'=>1, 'style'=>1, 'ul'=>1), 'typemustmatch'=>array('object'=>1), 'usemap'=>array('img'=>1, 'input'=>1, 'object'=>1), 'valign'=>array('col'=>1, 'colgroup'=>1, 'tbody'=>1, 'td'=>1, 'tfoot'=>1, 'th'=>1, 'thead'=>1, 'tr'=>1), 'value'=>array('button'=>1, 'data'=>1, 'input'=>1, 'li'=>1, 'meter'=>1, 'option'=>1, 'param'=>1, 'progress'=>1), 'valuetype'=>array('param'=>1), 'vspace'=>array('applet'=>1, 'embed'=>1, 'img'=>1, 'object'=>1), 'width'=>array('applet'=>1, 'canvas'=>1, 'col'=>1, 'colgroup'=>1, 'embed'=>1, 'hr'=>1, 'iframe'=>1, 'img'=>1, 'input'=>1, 'object'=>1, 'pre'=>1, 'table'=>1, 'td'=>1, 'th'=>1, 'video'=>1), 'wmode'=>array('embed'=>1), 'wrap'=>array('textarea'=>1)); // Ele-specific
    485. 

  485. static $aNA = array('aria-activedescendant'=>1, 'aria-atomic'=>1, 'aria-autocomplete'=>1, 'aria-busy'=>1, 'aria-checked'=>1, 'aria-controls'=>1, 'aria-describedby'=>1, 'aria-disabled'=>1, 'aria-dropeffect'=>1, 'aria-expanded'=>1, 'aria-flowto'=>1, 'aria-grabbed'=>1, 'aria-haspopup'=>1, 'aria-hidden'=>1, 'aria-invalid'=>1, 'aria-label'=>1, 'aria-labelledby'=>1, 'aria-level'=>1, 'aria-live'=>1, 'aria-multiline'=>1, 'aria-multiselectable'=>1, 'aria-orientation'=>1, 'aria-owns'=>1, 'aria-posinset'=>1, 'aria-pressed'=>1, 'aria-readonly'=>1, 'aria-relevant'=>1, 'aria-required'=>1, 'aria-selected'=>1, 'aria-setsize'=>1, 'aria-sort'=>1, 'aria-valuemax'=>1, 'aria-valuemin'=>1, 'aria-valuenow'=>1, 'aria-valuetext'=>1); // ARIA
    486. 

  486. static $aNE = array('allowfullscreen'=>1, 'checkbox'=>1, 'checked'=>1, 'command'=>1, 'compact'=>1, 'declare'=>1, 'defer'=>1, 'default'=>1, 'disabled'=>1, 'hidden'=>1, 'inert'=>1, 'ismap'=>1, 'itemscope'=>1, 'multiple'=>1, 'nohref'=>1, 'noresize'=>1, 'noshade'=>1, 'nowrap'=>1, 'open'=>1, 'radio'=>1, 'readonly'=>1, 'required'=>1, 'reversed'=>1, 'selected'=>1); // Empty
    487. 

  487. static $aNO = array('onabort'=>1, 'onblur'=>1, 'oncanplay'=>1, 'oncanplaythrough'=>1, 'onchange'=>1, 'onclick'=>1, 'oncontextmenu'=>1, 'oncopy'=>1, 'oncuechange'=>1, 'oncut'=>1, 'ondblclick'=>1, 'ondrag'=>1, 'ondragend'=>1, 'ondragenter'=>1, 'ondragleave'=>1, 'ondragover'=>1, 'ondragstart'=>1, 'ondrop'=>1, 'ondurationchange'=>1, 'onemptied'=>1, 'onended'=>1, 'onerror'=>1, 'onfocus'=>1, 'onformchange'=>1, 'onforminput'=>1, 'oninput'=>1, 'oninvalid'=>1, 'onkeydown'=>1, 'onkeypress'=>1, 'onkeyup'=>1, 'onload'=>1, 'onloadeddata'=>1, 'onloadedmetadata'=>1, 'onloadstart'=>1, 'onlostpointercapture'=>1, 'onmousedown'=>1, 'onmousemove'=>1, 'onmouseout'=>1, 'onmouseover'=>1, 'onmouseup'=>1, 'onmousewheel'=>1, 'onpaste'=>1, 'onpause'=>1, 'onplay'=>1, 'onplaying'=>1, 'onpointercancel'=>1, 'ongotpointercapture'=>1, 'onpointerdown'=>1, 'onpointerenter'=>1, 'onpointerleave'=>1, 'onpointermove'=>1, 'onpointerout'=>1, 'onpointerover'=>1, 'onpointerup'=>1, 'onprogress'=>1, 'onratechange'=>1, 'onreadystatechange'=>1, 'onreset'=>1, 'onsearch'=>1, 'onscroll'=>1, 'onseeked'=>1, 'onseeking'=>1, 'onselect'=>1, 'onshow'=>1, 'onstalled'=>1, 'onsubmit'=>1, 'onsuspend'=>1, 'ontimeupdate'=>1, 'ontoggle'=>1, 'ontouchcancel'=>1, 'ontouchend'=>1, 'ontouchmove'=>1, 'ontouchstart'=>1, 'onvolumechange'=>1, 'onwaiting'=>1, 'onwheel'=>1); // Event
    488. 

  488. static $aNP = array('action'=>1, 'cite'=>1, 'classid'=>1, 'codebase'=>1, 'data'=>1, 'href'=>1, 'itemtype'=>1, 'longdesc'=>1, 'model'=>1, 'pluginspage'=>1, 'pluginurl'=>1, 'src'=>1, 'srcset'=>1, 'usemap'=>1); // Need scheme check; excludes style, on*
    489. 

  489. static $aNU = array('accesskey'=>1, 'class'=>1, 'contenteditable'=>1, 'contextmenu'=>1, 'dir'=>1, 'draggable'=>1, 'dropzone'=>1, 'hidden'=>1, 'id'=>1, 'inert'=>1, 'itemid'=>1, 'itemprop'=>1, 'itemref'=>1, 'itemscope'=>1, 'itemtype'=>1, 'lang'=>1, 'role'=>1, 'spellcheck'=>1, 'style'=>1, 'tabindex'=>1, 'title'=>1, 'translate'=>1, 'xmlns'=>1, 'xml:base'=>1, 'xml:lang'=>1, 'xml:space'=>1); // Univ; excludes on*, aria*
    490. 

  490. 

  491. if($C['lc_std_val']){
    492. 

  492.  // predef attr vals for $eAL & $aNE ele
    493. 

  493.  static $aNL = array('all'=>1, 'auto'=>1, 'baseline'=>1, 'bottom'=>1, 'button'=>1, 'captions'=>1, 'center'=>1, 'chapters'=>1, 'char'=>1, 'checkbox'=>1, 'circle'=>1, 'col'=>1, 'colgroup'=>1, 'color'=>1, 'cols'=>1, 'data'=>1, 'date'=>1, 'datetime'=>1, 'datetime-local'=>1, 'default'=>1, 'descriptions'=>1, 'email'=>1, 'file'=>1, 'get'=>1, 'groups'=>1, 'hidden'=>1, 'image'=>1, 'justify'=>1, 'left'=>1, 'ltr'=>1, 'metadata'=>1, 'middle'=>1, 'month'=>1, 'none'=>1, 'number'=>1, 'object'=>1, 'password'=>1, 'poly'=>1, 'post'=>1, 'preserve'=>1, 'radio'=>1, 'range'=>1, 'rect'=>1, 'ref'=>1, 'reset'=>1, 'right'=>1, 'row'=>1, 'rowgroup'=>1, 'rows'=>1, 'rtl'=>1, 'search'=>1, 'submit'=>1, 'subtitles'=>1, 'tel'=>1, 'text'=>1, 'time'=>1, 'top'=>1, 'url'=>1, 'week'=>1);
    494. 

  494.  static $eAL = array('a'=>1, 'area'=>1, 'bdo'=>1, 'button'=>1, 'col'=>1, 'fieldset'=>1, 'form'=>1, 'img'=>1, 'input'=>1, 'object'=>1, 'ol'=>1, 'optgroup'=>1, 'option'=>1, 'param'=>1, 'script'=>1, 'select'=>1, 'table'=>1, 'td'=>1, 'textarea'=>1, 'tfoot'=>1, 'th'=>1, 'thead'=>1, 'tr'=>1, 'track'=>1, 'xml:space'=>1);
    495. 

  495.  $lcase = isset($eAL[$e]) ? 1 : 0;
    496. 

  496. }
    497. 

  497. 

  498. $depTr = 0;
    499. 

  499. if($C['no_deprecated_attr']){
    500. 

  500.  // depr attr:applicable ele
    501. 

  501.  static $aND = array('align'=>array('caption'=>1, 'div'=>1, 'h1'=>1, 'h2'=>1, 'h3'=>1, 'h4'=>1, 'h5'=>1, 'h6'=>1, 'hr'=>1, 'img'=>1, 'input'=>1, 'legend'=>1, 'object'=>1, 'p'=>1, 'table'=>1), 'bgcolor'=>array('table'=>1, 'td'=>1, 'th'=>1, 'tr'=>1), 'border'=>array('object'=>1), 'bordercolor'=>array('table'=>1, 'td'=>1, 'tr'=>1), 'cellspacing'=>array('table'=>1), 'clear'=>array('br'=>1), 'compact'=>array('dl'=>1, 'ol'=>1, 'ul'=>1), 'height'=>array('td'=>1, 'th'=>1), 'hspace'=>array('img'=>1, 'object'=>1), 'language'=>array('script'=>1), 'name'=>array('a'=>1, 'form'=>1, 'iframe'=>1, 'img'=>1, 'map'=>1), 'noshade'=>array('hr'=>1), 'nowrap'=>array('td'=>1, 'th'=>1), 'size'=>array('hr'=>1), 'vspace'=>array('img'=>1, 'object'=>1), 'width'=>array('hr'=>1, 'pre'=>1, 'table'=>1, 'td'=>1, 'th'=>1));
    502. 

  502.  static $eAD = array('a'=>1, 'br'=>1, 'caption'=>1, 'div'=>1, 'dl'=>1, 'form'=>1, 'h1'=>1, 'h2'=>1, 'h3'=>1, 'h4'=>1, 'h5'=>1, 'h6'=>1, 'hr'=>1, 'iframe'=>1, 'img'=>1, 'input'=>1, 'legend'=>1, 'map'=>1, 'object'=>1, 'ol'=>1, 'p'=>1, 'pre'=>1, 'script'=>1, 'table'=>1, 'td'=>1, 'th'=>1, 'tr'=>1, 'ul'=>1);
    503. 

  503.  $depTr = isset($eAD[$e]) ? 1 : 0;
    504. 

  504. }
    505. 

  505. 

  506. // attr name-vals
    507. 

  507. if(strpos($a, "\x01") !== false){$a = preg_replace('`\x01[^\x01]*\x01`', '', $a);} // No comment/CDATA sec
    508. 

  508. $mode = 0; $a = trim($a, ' /'); $aA = array();
    509. 

  509. while(strlen($a)){
    510. 

  510.  $w = 0;
    511. 

  511.  switch($mode){
    512. 

  512.   case 0: // Name
    513. 

  513.    if(preg_match('`^[a-zA-Z][^\s=/]+`', $a, $m)){
    514. 

  514.     $nm = strtolower($m[0]);
    515. 

  515.     $w = $mode = 1; $a = ltrim(substr_replace($a, '', 0, strlen($m[0])));
    516. 

  516.    }
    517. 

  517.   break; case 1:
    518. 

  518.    if($a[0] == '='){ // =
    519. 

  519.     $w = 1; $mode = 2; $a = ltrim($a, '= ');
    520. 

  520.    }else{ // No val
    521. 

  521.     $w = 1; $mode = 0; $a = ltrim($a);
    522. 

  522.     $aA[$nm] = '';
    523. 

  523.    }
    524. 

  524.   break; case 2: // Val
    525. 

  525.    if(preg_match('`^((?:"[^"]*")|(?:\'[^\']*\')|(?:\s*[^\s"\']+))(.*)`', $a, $m)){
    526. 

  526.     $a = ltrim($m[2]); $m = $m[1]; $w = 1; $mode = 0;
    527. 

  527.     $aA[$nm] = trim(str_replace('<', '&lt;', ($m[0] == '"' or $m[0] == '\'') ? substr($m, 1, -1) : $m));
    528. 

  528.    }
    529. 

  529.   break;
    530. 

  530.  }
    531. 

  531.  if($w == 0){ // Parse errs, deal with space, " & '
    532. 

  532.   $a = preg_replace('`^(?:"[^"]*("|$)|\'[^\']*(\'|$)|\S)*\s*`', '', $a);
    533. 

  533.   $mode = 0;
    534. 

  534.  }
    535. 

  535. }
    536. 

  536. if($mode == 1){$aA[$nm] = '';}
    537. 

  537. 

  538. // clean attrs
    539. 

  539. global $S;
    540. 

  540. $rl = isset($S[$e]) ? $S[$e] : array();
    541. 

  541. $a = array(); $nfr = 0; $d = $C['deny_attribute'];
    542. 

  542. foreach($aA as $k=>$v){
    543. 

  543.  if(((isset($d['*']) ? isset($d[$k]) : !isset($d[$k])) && (isset($aN[$k][$e]) or isset($aNU[$k]) or (isset($aNO[$k]) && !isset($d['on*'])) or (isset($aNA[$k]) && !isset($d['aria*'])) or (!isset($d['data*']) && preg_match('`data-((?!xml)[^:]+$)`', $k))) && !isset($rl['n'][$k]) && !isset($rl['n']['*'])) or isset($rl[$k])){
    544. 

  544.   if(isset($aNE[$k])){$v = $k;}
    545. 

  545.   elseif(!empty($lcase) && (($e != 'button' or $e != 'input') or $k == 'type')){ // Rather loose but ?not cause issues
    546. 

  546.    $v = (isset($aNL[($v2 = strtolower($v))])) ? $v2 : $v;
    547. 

  547.   }
    548. 

  548.   if($k == 'style' && !$C['style_pass']){
    549. 

  549.    if(false !== strpos($v, '&#')){
    550. 

  550.     static $sC = array('&#x20;'=>' ', '&#32;'=>' ', '&#x45;'=>'e', '&#69;'=>'e', '&#x65;'=>'e', '&#101;'=>'e', '&#x58;'=>'x', '&#88;'=>'x', '&#x78;'=>'x', '&#120;'=>'x', '&#x50;'=>'p', '&#80;'=>'p', '&#x70;'=>'p', '&#112;'=>'p', '&#x53;'=>'s', '&#83;'=>'s', '&#x73;'=>'s', '&#115;'=>'s', '&#x49;'=>'i', '&#73;'=>'i', '&#x69;'=>'i', '&#105;'=>'i', '&#x4f;'=>'o', '&#79;'=>'o', '&#x6f;'=>'o', '&#111;'=>'o', '&#x4e;'=>'n', '&#78;'=>'n', '&#x6e;'=>'n', '&#110;'=>'n', '&#x55;'=>'u', '&#85;'=>'u', '&#x75;'=>'u', '&#117;'=>'u', '&#x52;'=>'r', '&#82;'=>'r', '&#x72;'=>'r', '&#114;'=>'r', '&#x4c;'=>'l', '&#76;'=>'l', '&#x6c;'=>'l', '&#108;'=>'l', '&#x28;'=>'(', '&#40;'=>'(', '&#x29;'=>')', '&#41;'=>')', '&#x20;'=>':', '&#32;'=>':', '&#x22;'=>'"', '&#34;'=>'"', '&#x27;'=>"'", '&#39;'=>"'", '&#x2f;'=>'/', '&#47;'=>'/', '&#x2a;'=>'*', '&#42;'=>'*', '&#x5c;'=>'\\', '&#92;'=>'\\');
    551. 

  551.     $v = strtr($v, $sC);
    552. 

  552.    }
    553. 

  553.    $v = preg_replace_callback('`(url(?:\()(?: )*(?:\'|"|&(?:quot|apos);)?)(.+?)((?:\'|"|&(?:quot|apos);)?(?: )*(?:\)))`iS', 'hl_prot', $v);
    554. 

  554.    $v = !$C['css_expression'] ? preg_replace('`expression`i', ' ', preg_replace('`\\\\\S|(/|(%2f))(\*|(%2a))`i', ' ', $v)) : $v;
    555. 

  555.   }elseif(isset($aNP[$k]) or isset($aNO[$k])){
    556. 

  556.    $v = str_replace("­", ' ', (strpos($v, '&') !== false ? str_replace(array('&#xad;', '&#173;', '&shy;'), ' ', $v) : $v)); # double-quoted char: soft-hyphen; appears here as "­" or hyphen or something else depending on viewing software
    557. 

  557.    if($k == 'srcset'){
    558. 

  558.     $v2 = '';
    559. 

  559.     foreach(explode(',', $v) as $k1=>$v1){
    560. 

  560.      $v1 = explode(' ', ltrim($v1), 2);
    561. 

  561.      $k1 = isset($v1[1]) ? trim($v1[1]) : '';
    562. 

  562.      $v1 = trim($v1[0]);
    563. 

  563.      if(isset($v1[0])){$v2 .= hl_prot($v1, $k). (empty($k1) ? '' : ' '. $k1). ', ';}
    564. 

  564.     }
    565. 

  565.     $v = trim($v2, ', ');
    566. 

  566.    }
    567. 

  567.    if($k == 'itemtype'){
    568. 

  568.     $v2 = '';
    569. 

  569.     foreach(explode(' ', $v) as $v1){
    570. 

  570.      if(isset($v1[0])){$v2 .= hl_prot($v1, $k). ' ';}
    571. 

  571.     }
    572. 

  572.     $v = trim($v2, ' ');
    573. 

  573.    }
    574. 

  574.    else{$v = hl_prot($v, $k);}
    575. 

  575.    if($k == 'href'){ // X-spam
    576. 

  576.     if($C['anti_mail_spam'] && strpos($v, 'mailto:') === 0){
    577. 

  577.      $v = str_replace('@', htmlspecialchars($C['anti_mail_spam']), $v);
    578. 

  578.     }elseif($C['anti_link_spam']){
    579. 

  579.      $r1 = $C['anti_link_spam'][1];
    580. 

  580.      if(!empty($r1) && preg_match($r1, $v)){continue;}
    581. 

  581.      $r0 = $C['anti_link_spam'][0];
    582. 

  582.      if(!empty($r0) && preg_match($r0, $v)){
    583. 

  583.       if(isset($a['rel'])){
    584. 

  584.        if(!preg_match('`\bnofollow\b`i', $a['rel'])){$a['rel'] .= ' nofollow';}
    585. 

  585.       }elseif(isset($aA['rel'])){
    586. 

  586.        if(!preg_match('`\bnofollow\b`i', $aA['rel'])){$nfr = 1;}
    587. 

  587.       }else{$a['rel'] = 'nofollow';}
    588. 

  588.      }
    589. 

  589.     }
    590. 

  590.    }
    591. 

  591.   }
    592. 

  592.   if(isset($rl[$k]) && is_array($rl[$k]) && ($v = hl_attrval($k, $v, $rl[$k])) === 0){continue;}
    593. 

  593.   $a[$k] = str_replace('"', '&quot;', $v);
    594. 

  594.  }
    595. 

  595. }
    596. 

  596. if($nfr){$a['rel'] = isset($a['rel']) ? $a['rel']. ' nofollow' : 'nofollow';}
    597. 

  597. 

  598. // rqd attr
    599. 

  599. static $eAR = array('area'=>array('alt'=>'area'), 'bdo'=>array('dir'=>'ltr'), 'command'=>array('label'=>''), 'form'=>array('action'=>''), 'img'=>array('src'=>'', 'alt'=>'image'), 'map'=>array('name'=>''), 'optgroup'=>array('label'=>''), 'param'=>array('name'=>''), 'style'=>array('scoped'=>''), 'textarea'=>array('rows'=>'10', 'cols'=>'50'));
    600. 

  600. if(isset($eAR[$e])){
    601. 

  601.  foreach($eAR[$e] as $k=>$v){
    602. 

  602.   if(!isset($a[$k])){$a[$k] = isset($v[0]) ? $v : $k;}
    603. 

  603.  }
    604. 

  604. }
    605. 

  605. 

  606. // depr attr
    607. 

  607. if($depTr){
    608. 

  608.  $c = array();
    609. 

  609.  foreach($a as $k=>$v){
    610. 

  610.   if($k == 'style' or !isset($aND[$k][$e])){continue;}
    611. 

  611.   $v = str_replace(array('\\', ':', ';', '&#'), '', $v);
    612. 

  612.   if($k == 'align'){
    613. 

  613.    unset($a['align']);
    614. 

  614.    if($e == 'img' && ($v == 'left' or $v == 'right')){$c[] = 'float: '. $v;}
    615. 

  615.    elseif(($e == 'div' or $e == 'table') && $v == 'center'){$c[] = 'margin: auto';}
    616. 

  616.    else{$c[] = 'text-align: '. $v;}
    617. 

  617.   }elseif($k == 'bgcolor'){
    618. 

  618.    unset($a['bgcolor']);
    619. 

  619.    $c[] = 'background-color: '. $v;
    620. 

  620.   }elseif($k == 'border'){
    621. 

  621.    unset($a['border']); $c[] = "border: {$v}px";
    622. 

  622.   }elseif($k == 'bordercolor'){
    623. 

  623.    unset($a['bordercolor']); $c[] = 'border-color: '. $v;
    624. 

  624.   }elseif($k == 'cellspacing'){
    625. 

  625.    unset($a['cellspacing']); $c[] = "border-spacing: {$v}px";
    626. 

  626.   }elseif($k == 'clear'){
    627. 

  627.    unset($a[…
    628.

Large files files are truncated, but you can click here to view the full file