PageRenderTime 67ms CodeModel.GetById 6ms RepoModel.GetById 0ms app.codeStats 1ms

/administrator/components/com_virtuemart/helpers/vmfilter.php

https://github.com/srgg6701/auction-ruseasons
PHP | 1060 lines | 927 code | 40 blank | 93 comment | 328 complexity | bc2a7b21d3c9d9f167d0848542931241 MD5 | raw file
Possible License(s): GPL-2.0, LGPL-3.0, LGPL-2.1, BSD-3-Clause, JSON

Large files files are truncated, but you can click here to view the full file

    

  1. <?php
    2. 

  2. defined('_JEXEC') or die('');
    3. 

  3. /*
    4. 

  4.  htmLawed 1.1.10, 5 April 2012
    5. 

  5. OOP code, 5 April 2012
    6. 

  6. Copyright Santosh Patnaik
    7. 

  7. Dual LGPL v3 and GPL v2+ license
    8. 

  8. Modified for Virtuemart 2 by vm2 dev team(Patrick Kohl)
    9. 

  9. A PHP Labware internal utility; www.bioinformatics.org/phplabware/internal_utilities/htmLawed
    10. 

  10. $out = vmFilter::hl($in, array('safe'=>1, 'elements'=>'a, b, strong, i, em, li, ol, ul'));
    11. 

  11. See htmLawed_README.txt/htm
    12. 

  12. only good for HTML filtering needed in MultiVendor editing Product/category ...
    13. 

  13. */
    14. 

  14. 

  15. class vmFilter{
    16. 

  16. 

  17. 	private static $C=null;
    18. 

  18. 	private static $E=null;
    19. 

  19. 	private static $S=null;
    20. 

  20. 	private static $hl_Ids=null;
    21. 

  21. 

  22. 	// begin class
    23. 

  23. 	public static function hl($t, $C=null, $S=array()){
    24. 

  24. 		if ( is_string($C) ) $C = vmFilter::loadconfig($C);
    25. 

  25. 		$C = is_array($C) ? $C : array();
    26. 

  26. 

  27. 		if(!empty($C['valid_xhtml'])){
    28. 

  28. 			$C['elements'] = empty($C['elements']) ? '*-center-dir-font-isindex-menu-s-strike-u' : $C['elements'];
    29. 

  29. 			$C['make_tag_strict'] = isset($C['make_tag_strict']) ? $C['make_tag_strict'] : 2;
    30. 

  30. 			$C['xml:lang'] = isset($C['xml:lang']) ? $C['xml:lang'] : 2;
    31. 

  31. 		}
    32. 

  32. 		// config eles
    33. 

  33. 		$e = array('a'=>1, 'abbr'=>1, 'acronym'=>1, 'address'=>1, 'applet'=>1, 'area'=>1, 'b'=>1, 'bdo'=>1, 'big'=>1, 'blockquote'=>1, 'br'=>1, 'button'=>1, 'caption'=>1, 'center'=>1, 'cite'=>1, 'code'=>1, 'col'=>1, 'colgroup'=>1, 'dd'=>1, 'del'=>1, 'dfn'=>1, 'dir'=>1, 'div'=>1, 'dl'=>1, 'dt'=>1, 'em'=>1, 'embed'=>1, 'fieldset'=>1, 'font'=>1, 'form'=>1, 'h1'=>1, 'h2'=>1, 'h3'=>1, 'h4'=>1, 'h5'=>1, 'h6'=>1, 'hr'=>1, 'i'=>1, 'iframe'=>1, 'img'=>1, 'input'=>1, 'ins'=>1, 'isindex'=>1, 'kbd'=>1, 'label'=>1, 'legend'=>1, 'li'=>1, 'map'=>1, 'menu'=>1, 'noscript'=>1, 'object'=>1, 'ol'=>1, 'optgroup'=>1, 'option'=>1, 'p'=>1, 'param'=>1, 'pre'=>1, 'q'=>1, 'rb'=>1, 'rbc'=>1, 'rp'=>1, 'rt'=>1, 'rtc'=>1, 'ruby'=>1, 's'=>1, 'samp'=>1, 'script'=>1, 'select'=>1, 'small'=>1, 'span'=>1, 'strike'=>1, 'strong'=>1, 'sub'=>1, 'sup'=>1, 'table'=>1, 'tbody'=>1, 'td'=>1, 'textarea'=>1, 'tfoot'=>1, 'th'=>1, 'thead'=>1, 'tr'=>1, 'tt'=>1, 'u'=>1, 'ul'=>1, 'var'=>1); // 86/deprecated+embed+ruby
    34. 

  34. 		if(!empty($C['safe'])){
    35. 

  35. 			unset($e['applet'], $e['embed'], $e['iframe'], $e['object'], $e['script']);
    36. 

  36. 		}
    37. 

  37. 		$x = !empty($C['elements']) ? str_replace(array("\n", "\r", "\t", ' '), '', $C['elements']) : '*';
    38. 

  38. 		if($x == '-*'){
    39. 

  39. 			$e = array();
    40. 

  40. 		}
    41. 

  41. 		elseif(strpos($x, '*') === false){
    42. 

  42. 			$e = array_flip(explode(',', $x));
    43. 

  43. 		}
    44. 

  44. 		else{
    45. 

  45. 			if(isset($x[1])){
    46. 

  46. 				preg_match_all('`(?:^|-|\+)[^\-+]+?(?=-|\+|$)`', $x, $m, PREG_SET_ORDER);
    47. 

  47. 				for($i=count($m); --$i>=0;){
    48. 

  48. 					$m[$i] = $m[$i][0];
    49. 

  49. 				}
    50. 

  50. 				foreach($m as $v){
    51. 

  51. 					if($v[0] == '+'){
    52. 

  52. 						$e[substr($v, 1)] = 1;
    53. 

  53. 					}
    54. 

  54. 					if($v[0] == '-' && isset($e[($v = substr($v, 1))]) && !in_array('+'. $v, $m)){
    55. 

  55. 						unset($e[$v]);
    56. 

  56. 					}
    57. 

  57. 				}
    58. 

  58. 			}
    59. 

  59. 		}
    60. 

  60. 		$C['elements'] =& $e;
    61. 

  61. 		// config attrs
    62. 

  62. 		$x = !empty($C['deny_attribute']) ? str_replace(array("\n", "\r", "\t", ' '), '', $C['deny_attribute']) : '';
    63. 

  63. 		$x = array_flip((isset($x[0]) && $x[0] == '*') ? explode('-', $x) : explode(',', $x. (!empty($C['safe']) ? ',on*' : '')));
    64. 

  64. 		if(isset($x['on*'])){
    65. 

  65. 			unset($x['on*']);
    66. 

  66. 			$x += array('onblur'=>1, 'onchange'=>1, 'onclick'=>1, 'ondblclick'=>1, 'onfocus'=>1, 'onkeydown'=>1, 'onkeypress'=>1, 'onkeyup'=>1, 'onmousedown'=>1, 'onmousemove'=>1, 'onmouseout'=>1, 'onmouseover'=>1, 'onmouseup'=>1, 'onreset'=>1, 'onselect'=>1, 'onsubmit'=>1);
    67. 

  67. 		}
    68. 

  68. 		$C['deny_attribute'] = $x;
    69. 

  69. 		// config URL
    70. 

  70. 		$x = (isset($C['schemes'][2]) && strpos($C['schemes'], ':')) ? strtolower($C['schemes']) : 'href: aim, feed, file, ftp, gopher, http, https, irc, mailto, news, nntp, sftp, ssh, telnet; *:file, http, https';
    71. 

  71. 		$C['schemes'] = array();
    72. 

  72. 		foreach(explode(';', str_replace(array(' ', "\t", "\r", "\n"), '', $x)) as $v){
    73. 

  73. 			$x = $x2 = null; list($x, $x2) = explode(':', $v, 2);
    74. 

  74. 			if($x2){
    75. 

  75. 				$C['schemes'][$x] = array_flip(explode(',', $x2));
    76. 

  76. 			}
    77. 

  77. 		}
    78. 

  78. 		if(!isset($C['schemes']['*'])){
    79. 

  79. 			$C['schemes']['*'] = array('file'=>1, 'http'=>1, 'https'=>1,);
    80. 

  80. 		}
    81. 

  81. 		if(!empty($C['safe']) && empty($C['schemes']['style'])){
    82. 

  82. 			$C['schemes']['style'] = array('!'=>1);
    83. 

  83. 		}
    84. 

  84. 		$C['abs_url'] = isset($C['abs_url']) ? $C['abs_url'] : 0;
    85. 

  85. 		if(!isset($C['base_url']) or !preg_match('`^[a-zA-Z\d.+\-]+://[^/]+/(.+?/)?$`', $C['base_url'])){
    86. 

  86. 			$C['base_url'] = $C['abs_url'] = 0;
    87. 

  87. 		}
    88. 

  88. 		// config rest
    89. 

  89. 		$C['and_mark'] = empty($C['and_mark']) ? 0 : 1;
    90. 

  90. 		$C['anti_link_spam'] = (isset($C['anti_link_spam']) && is_array($C['anti_link_spam']) && count($C['anti_link_spam']) == 2 && (empty($C['anti_link_spam'][0]) or vmFilter::hl_regex($C['anti_link_spam'][0])) && (empty($C['anti_link_spam'][1]) or vmFilter::hl_regex($C['anti_link_spam'][1]))) ? $C['anti_link_spam'] : 0;
    91. 

  91. 		$C['anti_mail_spam'] = isset($C['anti_mail_spam']) ? $C['anti_mail_spam'] : 0;
    92. 

  92. 		$C['balance'] = isset($C['balance']) ? (bool)$C['balance'] : 1;
    93. 

  93. 		$C['cdata'] = isset($C['cdata']) ? $C['cdata'] : (empty($C['safe']) ? 3 : 0);
    94. 

  94. 		$C['clean_ms_char'] = empty($C['clean_ms_char']) ? 0 : $C['clean_ms_char'];
    95. 

  95. 		$C['comment'] = isset($C['comment']) ? $C['comment'] : (empty($C['safe']) ? 3 : 0);
    96. 

  96. 		$C['css_expression'] = empty($C['css_expression']) ? 0 : 1;
    97. 

  97. 		$C['direct_list_nest'] = empty($C['direct_list_nest']) ? 0 : 1;
    98. 

  98. 		$C['hexdec_entity'] = isset($C['hexdec_entity']) ? $C['hexdec_entity'] : 1;
    99. 

  99. 		$C['hook'] = (!empty($C['hook']) && function_exists($C['hook'])) ? $C['hook'] : 0;
    100. 

  100. 		$C['hook_tag'] = (!empty($C['hook_tag']) && function_exists($C['hook_tag'])) ? $C['hook_tag'] : 0;
    101. 

  101. 		$C['keep_bad'] = isset($C['keep_bad']) ? $C['keep_bad'] : 6;
    102. 

  102. 		$C['lc_std_val'] = isset($C['lc_std_val']) ? (bool)$C['lc_std_val'] : 1;
    103. 

  103. 		$C['make_tag_strict'] = isset($C['make_tag_strict']) ? $C['make_tag_strict'] : 1;
    104. 

  104. 		$C['named_entity'] = isset($C['named_entity']) ? (bool)$C['named_entity'] : 1;
    105. 

  105. 		$C['no_deprecated_attr'] = isset($C['no_deprecated_attr']) ? $C['no_deprecated_attr'] : 1;
    106. 

  106. 		$C['parent'] = isset($C['parent'][0]) ? strtolower($C['parent']) : 'body';
    107. 

  107. 		$C['show_setting'] = !empty($C['show_setting']) ? $C['show_setting'] : 0;
    108. 

  108. 		$C['style_pass'] = empty($C['style_pass']) ? 0 : 1;
    109. 

  109. 		$C['tidy'] = empty($C['tidy']) ? 0 : $C['tidy'];
    110. 

  110. 		$C['unique_ids'] = isset($C['unique_ids']) ? $C['unique_ids'] : 1;
    111. 

  111. 		$C['xml:lang'] = isset($C['xml:lang']) ? $C['xml:lang'] : 0;
    112. 

  112. 

  113. 		if(!is_null(vmFilter::$C)){
    114. 

  114. 			$reC = vmFilter::$C;
    115. 

  115. 		}
    116. 

  116. 		vmFilter::$C = $C;
    117. 

  117. 		$S = is_array($S) ? $S : vmFilter::$hl_spec($S);
    118. 

  118. 		if(!is_null(vmFilter::$S)){
    119. 

  119. 			$reS = vmFilter::$S;
    120. 

  120. 		}
    121. 

  121. 		vmFilter::$S = $S;
    122. 

  122. 

  123. 		$t = preg_replace('`[\x00-\x08\x0b-\x0c\x0e-\x1f]`', '', $t);
    124. 

  124. 		if($C['clean_ms_char']){
    125. 

  125. 			$x = array("\x7f"=>'', "\x80"=>'&#8364;', "\x81"=>'', "\x83"=>'&#402;', "\x85"=>'&#8230;', "\x86"=>'&#8224;', "\x87"=>'&#8225;', "\x88"=>'&#710;', "\x89"=>'&#8240;', "\x8a"=>'&#352;', "\x8b"=>'&#8249;', "\x8c"=>'&#338;', "\x8d"=>'', "\x8e"=>'&#381;', "\x8f"=>'', "\x90"=>'', "\x95"=>'&#8226;', "\x96"=>'&#8211;', "\x97"=>'&#8212;', "\x98"=>'&#732;', "\x99"=>'&#8482;', "\x9a"=>'&#353;', "\x9b"=>'&#8250;', "\x9c"=>'&#339;', "\x9d"=>'', "\x9e"=>'&#382;', "\x9f"=>'&#376;');
    126. 

  126. 			$x = $x + ($C['clean_ms_char'] == 1 ? array("\x82"=>'&#8218;', "\x84"=>'&#8222;', "\x91"=>'&#8216;', "\x92"=>'&#8217;', "\x93"=>'&#8220;', "\x94"=>'&#8221;') : array("\x82"=>'\'', "\x84"=>'"', "\x91"=>'\'', "\x92"=>'\'', "\x93"=>'"', "\x94"=>'"'));
    127. 

  127. 			$t = strtr($t, $x);
    128. 

  128. 		}
    129. 

  129. 		if($C['cdata'] or $C['comment']){
    130. 

  130. 			$t = preg_replace_callback('`<!(?:(?:--.*?--)|(?:\[CDATA\[.*?\]\]))>`sm', 'vmFilter::hl_cmtcd', $t);
    131. 

  131. 		}
    132. 

  132. 		$t = preg_replace_callback('`&amp;([A-Za-z][A-Za-z0-9]{1,30}|#(?:[0-9]{1,8}|[Xx][0-9A-Fa-f]{1,7}));`', 'vmFilter::hl_ent', str_replace('&', '&amp;', $t));
    133. 

  133. 		if($C['unique_ids'] && is_null(vmFilter::$hl_Ids)){
    134. 

  134. 			vmFilter::$hl_Ids = array();
    135. 

  135. 		}
    136. 

  136. 		if($C['hook']){
    137. 

  137. 			$t = $C['hook']($t, $C, $S);
    138. 

  138. 		}
    139. 

  139. 		if($C['show_setting'] && preg_match('`^[a-z][a-z0-9_]*$`i', $C['show_setting'])){
    140. 

  140. 			vmFilter::$C['show_setting'] = array('config'=>$C, 'spec'=>$S, 'time'=>microtime());
    141. 

  141. 		}
    142. 

  142. 		// main
    143. 

  143. 		$t = preg_replace_callback('`<(?:(?:\s|$)|(?:[^>]*(?:>|$)))|>`m', 'vmFilter::hl_tag', $t);
    144. 

  144. 		$t = $C['balance'] ? vmFilter::hl_bal($t, $C['keep_bad'], $C['parent']) : $t;
    145. 

  145. 		$t = (($C['cdata'] or $C['comment']) && strpos($t, "\x01") !== false) ? str_replace(array("\x01", "\x02", "\x03", "\x04", "\x05"), array('', '', '&', '<', '>'), $t) : $t;
    146. 

  146. 		$t = $C['tidy'] ? vmFilter::hl_tidy($t, $C['tidy'], $C['parent']) : $t;
    147. 

  147. 		unset($C, $e);
    148. 

  148. 		if(isset($reC)){
    149. 

  149. 			vmFilter::$C = $reC;
    150. 

  150. 		}
    151. 

  151. 		if(isset($reS)){
    152. 

  152. 			vmFilter::$S = $reS;
    153. 

  153. 		}
    154. 

  154. 		return $t;
    155. 

  155. 		// eof
    156. 

  156. 	}
    157. 

  157. 

  158. 	public static function hl_attrval($t, $p){
    159. 

  159. 		// check attr val against $S
    160. 

  160. 		$o = 1; $l = strlen($t);
    161. 

  161. 		foreach($p as $k=>$v){
    162. 

  162. 			switch($k){
    163. 

  163. 				case 'maxlen':if($l > $v){
    164. 

  164. 					$o = 0;
    165. 

  165. 				}
    166. 

  166. 				break; case 'minlen': if($l < $v){
    167. 

  167. 					$o = 0;
    168. 

  168. 				}
    169. 

  169. 				break; case 'maxval': if((float)($t) > $v){
    170. 

  170. 					$o = 0;
    171. 

  171. 				}
    172. 

  172. 				break; case 'minval': if((float)($t) < $v){
    173. 

  173. 					$o = 0;
    174. 

  174. 				}
    175. 

  175. 				break; case 'match': if(!preg_match($v, $t)){
    176. 

  176. 					$o = 0;
    177. 

  177. 				}
    178. 

  178. 				break; case 'nomatch': if(preg_match($v, $t)){
    179. 

  179. 					$o = 0;
    180. 

  180. 				}
    181. 

  181. 				break; case 'oneof':
    182. 

  182. 					$m = 0;
    183. 

  183. 					foreach(explode('|', $v) as $n){
    184. 

  184. 						if($t == $n){
    185. 

  185. 							$m = 1; break;
    186. 

  186. 						}
    187. 

  187. 					}
    188. 

  188. 					$o = $m;
    189. 

  189. 					break; case 'noneof':
    190. 

  190. 						$m = 1;
    191. 

  191. 						foreach(explode('|', $v) as $n){
    192. 

  192. 							if($t == $n){
    193. 

  193. 								$m = 0; break;
    194. 

  194. 							}
    195. 

  195. 						}
    196. 

  196. 						$o = $m;
    197. 

  197. 						break; default:
    198. 

  198. 							break;
    199. 

  199. 			}
    200. 

  200. 			if(!$o){
    201. 

  201. 				break;
    202. 

  202. 			}
    203. 

  203. 		}
    204. 

  204. 		return ($o ? $t : (isset($p['default']) ? $p['default'] : 0));
    205. 

  205. 		// eof
    206. 

  206. 	}
    207. 

  207. 

  208. 	public static function hl_bal($t, $do=1, $in='div'){
    209. 

  209. 		// balance tags
    210. 

  210. 		// by content
    211. 

  211. 		$cB = array('blockquote'=>1, 'form'=>1, 'map'=>1, 'noscript'=>1); // Block
    212. 

  212. 		$cE = array('area'=>1, 'br'=>1, 'col'=>1, 'embed'=>1, 'hr'=>1, 'img'=>1, 'input'=>1, 'isindex'=>1, 'param'=>1); // Empty
    213. 

  213. 		$cF = array('button'=>1, 'del'=>1, 'div'=>1, 'dd'=>1, 'fieldset'=>1, 'iframe'=>1, 'ins'=>1, 'li'=>1, 'noscript'=>1, 'object'=>1, 'td'=>1, 'th'=>1); // Flow; later context-wise dynamic move of ins & del to $cI
    214. 

  214. 		$cI = array('a'=>1, 'abbr'=>1, 'acronym'=>1, 'address'=>1, 'b'=>1, 'bdo'=>1, 'big'=>1, 'caption'=>1, 'cite'=>1, 'code'=>1, 'dfn'=>1, 'dt'=>1, 'em'=>1, 'font'=>1, 'h1'=>1, 'h2'=>1, 'h3'=>1, 'h4'=>1, 'h5'=>1, 'h6'=>1, 'i'=>1, 'kbd'=>1, 'label'=>1, 'legend'=>1, 'p'=>1, 'pre'=>1, 'q'=>1, 'rb'=>1, 'rt'=>1, 's'=>1, 'samp'=>1, 'small'=>1, 'span'=>1, 'strike'=>1, 'strong'=>1, 'sub'=>1, 'sup'=>1, 'tt'=>1, 'u'=>1, 'var'=>1); // Inline
    215. 

  215. 		$cN = array('a'=>array('a'=>1), 'button'=>array('a'=>1, 'button'=>1, 'fieldset'=>1, 'form'=>1, 'iframe'=>1, 'input'=>1, 'label'=>1, 'select'=>1, 'textarea'=>1), 'fieldset'=>array('fieldset'=>1), 'form'=>array('form'=>1), 'label'=>array('label'=>1), 'noscript'=>array('script'=>1), 'pre'=>array('big'=>1, 'font'=>1, 'img'=>1, 'object'=>1, 'script'=>1, 'small'=>1, 'sub'=>1, 'sup'=>1), 'rb'=>array('ruby'=>1), 'rt'=>array('ruby'=>1)); // Illegal
    216. 

  216. 		$cN2 = array_keys($cN);
    217. 

  217. 		$cR = array('blockquote'=>1, 'dir'=>1, 'dl'=>1, 'form'=>1, 'map'=>1, 'menu'=>1, 'noscript'=>1, 'ol'=>1, 'optgroup'=>1, 'rbc'=>1, 'rtc'=>1, 'ruby'=>1, 'select'=>1, 'table'=>1, 'tbody'=>1, 'tfoot'=>1, 'thead'=>1, 'tr'=>1, 'ul'=>1);
    218. 

  218. 		$cS = array('colgroup'=>array('col'=>1), 'dir'=>array('li'=>1), 'dl'=>array('dd'=>1, 'dt'=>1), 'menu'=>array('li'=>1), 'ol'=>array('li'=>1), 'optgroup'=>array('option'=>1), 'option'=>array('#pcdata'=>1), 'rbc'=>array('rb'=>1), 'rp'=>array('#pcdata'=>1), 'rtc'=>array('rt'=>1), 'ruby'=>array('rb'=>1, 'rbc'=>1, 'rp'=>1, 'rt'=>1, 'rtc'=>1), 'select'=>array('optgroup'=>1, 'option'=>1), 'script'=>array('#pcdata'=>1), 'table'=>array('caption'=>1, 'col'=>1, 'colgroup'=>1, 'tfoot'=>1, 'tbody'=>1, 'tr'=>1, 'thead'=>1), 'tbody'=>array('tr'=>1), 'tfoot'=>array('tr'=>1), 'textarea'=>array('#pcdata'=>1), 'thead'=>array('tr'=>1), 'tr'=>array('td'=>1, 'th'=>1), 'ul'=>array('li'=>1)); // Specific - immediate parent-child
    219. 

  219. 		if(vmFilter::$C['direct_list_nest']){
    220. 

  220. 			$cS['ol'] = $cS['ul'] += array('ol'=>1, 'ul'=>1);
    221. 

  221. 		}
    222. 

  222. 		$cO = array('address'=>array('p'=>1), 'applet'=>array('param'=>1), 'blockquote'=>array('script'=>1), 'fieldset'=>array('legend'=>1, '#pcdata'=>1), 'form'=>array('script'=>1), 'map'=>array('area'=>1), 'object'=>array('param'=>1, 'embed'=>1)); // Other
    223. 

  223. 		$cT = array('colgroup'=>1, 'dd'=>1, 'dt'=>1, 'li'=>1, 'option'=>1, 'p'=>1, 'td'=>1, 'tfoot'=>1, 'th'=>1, 'thead'=>1, 'tr'=>1); // Omitable closing
    224. 

  224. 		// block/inline type; ins & del both type; #pcdata: text
    225. 

  225. 		$eB = array('address'=>1, 'blockquote'=>1, 'center'=>1, 'del'=>1, 'dir'=>1, 'dl'=>1, 'div'=>1, 'fieldset'=>1, 'form'=>1, 'ins'=>1, 'h1'=>1, 'h2'=>1, 'h3'=>1, 'h4'=>1, 'h5'=>1, 'h6'=>1, 'hr'=>1, 'isindex'=>1, 'menu'=>1, 'noscript'=>1, 'ol'=>1, 'p'=>1, 'pre'=>1, 'table'=>1, 'ul'=>1);
    226. 

  226. 		$eI = array('#pcdata'=>1, 'a'=>1, 'abbr'=>1, 'acronym'=>1, 'applet'=>1, 'b'=>1, 'bdo'=>1, 'big'=>1, 'br'=>1, 'button'=>1, 'cite'=>1, 'code'=>1, 'del'=>1, 'dfn'=>1, 'em'=>1, 'embed'=>1, 'font'=>1, 'i'=>1, 'iframe'=>1, 'img'=>1, 'input'=>1, 'ins'=>1, 'kbd'=>1, 'label'=>1, 'map'=>1, 'object'=>1, 'q'=>1, 'ruby'=>1, 's'=>1, 'samp'=>1, 'select'=>1, 'script'=>1, 'small'=>1, 'span'=>1, 'strike'=>1, 'strong'=>1, 'sub'=>1, 'sup'=>1, 'textarea'=>1, 'tt'=>1, 'u'=>1, 'var'=>1);
    227. 

  227. 		$eN = array('a'=>1, 'big'=>1, 'button'=>1, 'fieldset'=>1, 'font'=>1, 'form'=>1, 'iframe'=>1, 'img'=>1, 'input'=>1, 'label'=>1, 'object'=>1, 'ruby'=>1, 'script'=>1, 'select'=>1, 'small'=>1, 'sub'=>1, 'sup'=>1, 'textarea'=>1); // Exclude from specific ele; $cN values
    228. 

  228. 		$eO = array('area'=>1, 'caption'=>1, 'col'=>1, 'colgroup'=>1, 'dd'=>1, 'dt'=>1, 'legend'=>1, 'li'=>1, 'optgroup'=>1, 'option'=>1, 'param'=>1, 'rb'=>1, 'rbc'=>1, 'rp'=>1, 'rt'=>1, 'rtc'=>1, 'script'=>1, 'tbody'=>1, 'td'=>1, 'tfoot'=>1, 'thead'=>1, 'th'=>1, 'tr'=>1); // Missing in $eB & $eI
    229. 

  229. 		$eF = $eB + $eI;
    230. 

  230. 

  231. 		// $in sets allowed child
    232. 

  232. 		$in = ((isset($eF[$in]) && $in != '#pcdata') or isset($eO[$in])) ? $in : 'div';
    233. 

  233. 		if(isset($cE[$in])){
    234. 

  234. 			return (!$do ? '' : str_replace(array('<', '>'), array('&lt;', '&gt;'), $t));
    235. 

  235. 		}
    236. 

  236. 		if(isset($cS[$in])){
    237. 

  237. 			$inOk = $cS[$in];
    238. 

  238. 		}
    239. 

  239. 		elseif(isset($cI[$in])){
    240. 

  240. 			$inOk = $eI; $cI['del'] = 1; $cI['ins'] = 1;
    241. 

  241. 		}
    242. 

  242. 		elseif(isset($cF[$in])){
    243. 

  243. 			$inOk = $eF; unset($cI['del'], $cI['ins']);
    244. 

  244. 		}
    245. 

  245. 		elseif(isset($cB[$in])){
    246. 

  246. 			$inOk = $eB; unset($cI['del'], $cI['ins']);
    247. 

  247. 		}
    248. 

  248. 		if(isset($cO[$in])){
    249. 

  249. 			$inOk = $inOk + $cO[$in];
    250. 

  250. 		}
    251. 

  251. 		if(isset($cN[$in])){
    252. 

  252. 			$inOk = array_diff_assoc($inOk, $cN[$in]);
    253. 

  253. 		}
    254. 

  254. 

  255. 		$t = explode('<', $t);
    256. 

  256. 		$ok = $q = array(); // $q seq list of open non-empty ele
    257. 

  257. 		ob_start();
    258. 

  258. 

  259. 		for($i=-1, $ci=count($t); ++$i<$ci;){
    260. 

  260. 			// allowed $ok in parent $p
    261. 

  261. 			if($ql = count($q)){
    262. 

  262. 				$p = array_pop($q);
    263. 

  263. 				$q[] = $p;
    264. 

  264. 				if(isset($cS[$p])){
    265. 

  265. 					$ok = $cS[$p];
    266. 

  266. 				}
    267. 

  267. 				elseif(isset($cI[$p])){
    268. 

  268. 					$ok = $eI; $cI['del'] = 1; $cI['ins'] = 1;
    269. 

  269. 				}
    270. 

  270. 				elseif(isset($cF[$p])){
    271. 

  271. 					$ok = $eF; unset($cI['del'], $cI['ins']);
    272. 

  272. 				}
    273. 

  273. 				elseif(isset($cB[$p])){
    274. 

  274. 					$ok = $eB; unset($cI['del'], $cI['ins']);
    275. 

  275. 				}
    276. 

  276. 				if(isset($cO[$p])){
    277. 

  277. 					$ok = $ok + $cO[$p];
    278. 

  278. 				}
    279. 

  279. 				if(isset($cN[$p])){
    280. 

  280. 					$ok = array_diff_assoc($ok, $cN[$p]);
    281. 

  281. 				}
    282. 

  282. 			}else{$ok = $inOk; unset($cI['del'], $cI['ins']);
    283. 

  283. 			}
    284. 

  284. 			// bad tags, & ele content
    285. 

  285. 			if(isset($e) && ($do == 1 or (isset($ok['#pcdata']) && ($do == 3 or $do == 5)))){
    286. 

  286. 				echo '&lt;', $s, $e, $a, '&gt;';
    287. 

  287. 			}
    288. 

  288. 			if(isset($x[0])){
    289. 

  289. 				if($do < 3 or isset($ok['#pcdata'])){
    290. 

  290. 					echo $x;
    291. 

  291. 				}
    292. 

  292. 				elseif(strpos($x, "\x02\x04")){
    293. 

  293. 					foreach(preg_split('`(\x01\x02[^\x01\x02]+\x02\x01)`', $x, -1, PREG_SPLIT_DELIM_CAPTURE | PREG_SPLIT_NO_EMPTY) as $v){
    294. 

  294. 						echo (substr($v, 0, 2) == "\x01\x02" ? $v : ($do > 4 ? preg_replace('`\S`', '', $v) : ''));
    295. 

  295. 					}
    296. 

  296. 				}elseif($do > 4){
    297. 

  297. 					echo preg_replace('`\S`', '', $x);
    298. 

  298. 				}
    299. 

  299. 			}
    300. 

  300. 			// get markup
    301. 

  301. 			if(!preg_match('`^(/?)([a-zA-Z1-6]+)([^>]*)>(.*)`sm', $t[$i], $r)){
    302. 

  302. 				$x = $t[$i]; continue;
    303. 

  303. 			}
    304. 

  304. 			$s = null; $e = null; $a = null; $x = null; list($all, $s, $e, $a, $x) = $r;
    305. 

  305. 			// close tag
    306. 

  306. 			if($s){
    307. 

  307. 				if(isset($cE[$e]) or !in_array($e, $q)){
    308. 

  308. 					continue;
    309. 

  309. 				} // Empty/unopen
    310. 

  310. 				if($p == $e){
    311. 

  311. 					array_pop($q); echo '</', $e, '>'; unset($e); continue;
    312. 

  312. 				} // Last open
    313. 

  313. 				$add = ''; // Nesting - close open tags that need to be
    314. 

  314. 				for($j=-1, $cj=count($q); ++$j<$cj;){
    315. 

  315. 					if(($d = array_pop($q)) == $e){
    316. 

  316. 						break;
    317. 

  317. 					}
    318. 

  318. 					else{$add .= "</{$d}>";
    319. 

  319. 					}
    320. 

  320. 				}
    321. 

  321. 				echo $add, '</', $e, '>'; unset($e); continue;
    322. 

  322. 			}
    323. 

  323. 			// open tag
    324. 

  324. 			// $cB ele needs $eB ele as child
    325. 

  325. 			if(isset($cB[$e]) && strlen(trim($x))){
    326. 

  326. 				$t[$i] = "{$e}{$a}>";
    327. 

  327. 				array_splice($t, $i+1, 0, 'div>'. $x); unset($e, $x); ++$ci; --$i; continue;
    328. 

  328. 			}
    329. 

  329. 			if((($ql && isset($cB[$p])) or (isset($cB[$in]) && !$ql)) && !isset($eB[$e]) && !isset($ok[$e])){
    330. 

  330. 				array_splice($t, $i, 0, 'div>'); unset($e, $x); ++$ci; --$i; continue;
    331. 

  331. 			}
    332. 

  332. 			// if no open ele, $in = parent; mostly immediate parent-child relation should hold
    333. 

  333. 			if(!$ql or !isset($eN[$e]) or !array_intersect($q, $cN2)){
    334. 

  334. 				if(!isset($ok[$e])){
    335. 

  335. 					if($ql && isset($cT[$p])){
    336. 

  336. 						echo '</', array_pop($q), '>'; unset($e, $x); --$i;
    337. 

  337. 					}
    338. 

  338. 					continue;
    339. 

  339. 				}
    340. 

  340. 				if(!isset($cE[$e])){
    341. 

  341. 					$q[] = $e;
    342. 

  342. 				}
    343. 

  343. 				echo '<', $e, $a, '>'; unset($e); continue;
    344. 

  344. 			}
    345. 

  345. 			// specific parent-child
    346. 

  346. 			if(isset($cS[$p][$e])){
    347. 

  347. 				if(!isset($cE[$e])){
    348. 

  348. 					$q[] = $e;
    349. 

  349. 				}
    350. 

  350. 				echo '<', $e, $a, '>'; unset($e); continue;
    351. 

  351. 			}
    352. 

  352. 			// nesting
    353. 

  353. 			$add = '';
    354. 

  354. 			$q2 = array();
    355. 

  355. 			for($k=-1, $kc=count($q); ++$k<$kc;){
    356. 

  356. 				$d = $q[$k];
    357. 

  357. 				$ok2 = array();
    358. 

  358. 				if(isset($cS[$d])){
    359. 

  359. 					$q2[] = $d; continue;
    360. 

  360. 				}
    361. 

  361. 				$ok2 = isset($cI[$d]) ? $eI : $eF;
    362. 

  362. 				if(isset($cO[$d])){
    363. 

  363. 					$ok2 = $ok2 + $cO[$d];
    364. 

  364. 				}
    365. 

  365. 				if(isset($cN[$d])){
    366. 

  366. 					$ok2 = array_diff_assoc($ok2, $cN[$d]);
    367. 

  367. 				}
    368. 

  368. 				if(!isset($ok2[$e])){
    369. 

  369. 					if(!$k && !isset($inOk[$e])){
    370. 

  370. 						continue 2;
    371. 

  371. 					}
    372. 

  372. 					$add = "</{$d}>";
    373. 

  373. 					for(;++$k<$kc;){
    374. 

  374. 						$add = "</{$q[$k]}>{$add}";
    375. 

  375. 					}
    376. 

  376. 					break;
    377. 

  377. 				}
    378. 

  378. 				else{$q2[] = $d;
    379. 

  379. 				}
    380. 

  380. 			}
    381. 

  381. 			$q = $q2;
    382. 

  382. 			if(!isset($cE[$e])){
    383. 

  383. 				$q[] = $e;
    384. 

  384. 			}
    385. 

  385. 			echo $add, '<', $e, $a, '>'; unset($e); continue;
    386. 

  386. 		}
    387. 

  387. 

  388. 		// end
    389. 

  389. 		if($ql = count($q)){
    390. 

  390. 			$p = array_pop($q);
    391. 

  391. 			$q[] = $p;
    392. 

  392. 			if(isset($cS[$p])){
    393. 

  393. 				$ok = $cS[$p];
    394. 

  394. 			}
    395. 

  395. 			elseif(isset($cI[$p])){
    396. 

  396. 				$ok = $eI; $cI['del'] = 1; $cI['ins'] = 1;
    397. 

  397. 			}
    398. 

  398. 			elseif(isset($cF[$p])){
    399. 

  399. 				$ok = $eF; unset($cI['del'], $cI['ins']);
    400. 

  400. 			}
    401. 

  401. 			elseif(isset($cB[$p])){
    402. 

  402. 				$ok = $eB; unset($cI['del'], $cI['ins']);
    403. 

  403. 			}
    404. 

  404. 			if(isset($cO[$p])){
    405. 

  405. 				$ok = $ok + $cO[$p];
    406. 

  406. 			}
    407. 

  407. 			if(isset($cN[$p])){
    408. 

  408. 				$ok = array_diff_assoc($ok, $cN[$p]);
    409. 

  409. 			}
    410. 

  410. 		}else{$ok = $inOk; unset($cI['del'], $cI['ins']);
    411. 

  411. 		}
    412. 

  412. 		if(isset($e) && ($do == 1 or (isset($ok['#pcdata']) && ($do == 3 or $do == 5)))){
    413. 

  413. 			echo '&lt;', $s, $e, $a, '&gt;';
    414. 

  414. 		}
    415. 

  415. 		if(isset($x[0])){
    416. 

  416. 			if(strlen(trim($x)) && (($ql && isset($cB[$p])) or (isset($cB[$in]) && !$ql))){
    417. 

  417. 				echo '<div>', $x, '</div>';
    418. 

  418. 			}
    419. 

  419. 			elseif($do < 3 or isset($ok['#pcdata'])){
    420. 

  420. 				echo $x;
    421. 

  421. 			}
    422. 

  422. 			elseif(strpos($x, "\x02\x04")){
    423. 

  423. 				foreach(preg_split('`(\x01\x02[^\x01\x02]+\x02\x01)`', $x, -1, PREG_SPLIT_DELIM_CAPTURE | PREG_SPLIT_NO_EMPTY) as $v){
    424. 

  424. 					echo (substr($v, 0, 2) == "\x01\x02" ? $v : ($do > 4 ? preg_replace('`\S`', '', $v) : ''));
    425. 

  425. 				}
    426. 

  426. 			}elseif($do > 4){
    427. 

  427. 				echo preg_replace('`\S`', '', $x);
    428. 

  428. 			}
    429. 

  429. 		}
    430. 

  430. 		while(!empty($q) && ($e = array_pop($q))){
    431. 

  431. 			echo '</', $e, '>';
    432. 

  432. 		}
    433. 

  433. 		$o = ob_get_contents();
    434. 

  434. 		ob_end_clean();
    435. 

  435. 		return $o;
    436. 

  436. 		// eof
    437. 

  437. 	}
    438. 

  438. 

  439. 	public static function hl_cmtcd($t){
    440. 

  440. 		// comment/CDATA sec handler
    441. 

  441. 		$t = $t[0];
    442. 

  442. 		$C = vmFilter::$C;
    443. 

  443. 		if(!($v = $C[$n = $t[3] == '-' ? 'comment' : 'cdata'])){
    444. 

  444. 			return $t;
    445. 

  445. 		}
    446. 

  446. 		if($v == 1){
    447. 

  447. 			return '';
    448. 

  448. 		}
    449. 

  449. 		if($n == 'comment'){
    450. 

  450. 			if(substr(($t = preg_replace('`--+`', '-', substr($t, 4, -3))), -1) != ' '){
    451. 

  451. 				$t .= ' ';
    452. 

  452. 			}
    453. 

  453. 		}
    454. 

  454. 		else{$t = substr($t, 1, -1);
    455. 

  455. 		}
    456. 

  456. 		$t = $v == 2 ? str_replace(array('&', '<', '>'), array('&amp;', '&lt;', '&gt;'), $t) : $t;
    457. 

  457. 		return str_replace(array('&', '<', '>'), array("\x03", "\x04", "\x05"), ($n == 'comment' ? "\x01\x02\x04!--$t--\x05\x02\x01" : "\x01\x01\x04$t\x05\x01\x01"));
    458. 

  458. 		// eof
    459. 

  459. 	}
    460. 

  460. 

  461. 	public static function hl_ent($t){
    462. 

  462. 		// entitity handler
    463. 

  463. 		$C = vmFilter::$C;
    464. 

  464. 		$t = $t[1];
    465. 

  465. 		static $U = array('quot'=>1,'amp'=>1,'lt'=>1,'gt'=>1);
    466. 

  466. 		static $N = array('fnof'=>'402', 'Alpha'=>'913', 'Beta'=>'914', 'Gamma'=>'915', 'Delta'=>'916', 'Epsilon'=>'917', 'Zeta'=>'918', 'Eta'=>'919', 'Theta'=>'920', 'Iota'=>'921', 'Kappa'=>'922', 'Lambda'=>'923', 'Mu'=>'924', 'Nu'=>'925', 'Xi'=>'926', 'Omicron'=>'927', 'Pi'=>'928', 'Rho'=>'929', 'Sigma'=>'931', 'Tau'=>'932', 'Upsilon'=>'933', 'Phi'=>'934', 'Chi'=>'935', 'Psi'=>'936', 'Omega'=>'937', 'alpha'=>'945', 'beta'=>'946', 'gamma'=>'947', 'delta'=>'948', 'epsilon'=>'949', 'zeta'=>'950', 'eta'=>'951', 'theta'=>'952', 'iota'=>'953', 'kappa'=>'954', 'lambda'=>'955', 'mu'=>'956', 'nu'=>'957', 'xi'=>'958', 'omicron'=>'959', 'pi'=>'960', 'rho'=>'961', 'sigmaf'=>'962', 'sigma'=>'963', 'tau'=>'964', 'upsilon'=>'965', 'phi'=>'966', 'chi'=>'967', 'psi'=>'968', 'omega'=>'969', 'thetasym'=>'977', 'upsih'=>'978', 'piv'=>'982', 'bull'=>'8226', 'hellip'=>'8230', 'prime'=>'8242', 'Prime'=>'8243', 'oline'=>'8254', 'frasl'=>'8260', 'weierp'=>'8472', 'image'=>'8465', 'real'=>'8476', 'trade'=>'8482', 'alefsym'=>'8501', 'larr'=>'8592', 'uarr'=>'8593', 'rarr'=>'8594', 'darr'=>'8595', 'harr'=>'8596', 'crarr'=>'8629', 'lArr'=>'8656', 'uArr'=>'8657', 'rArr'=>'8658', 'dArr'=>'8659', 'hArr'=>'8660', 'forall'=>'8704', 'part'=>'8706', 'exist'=>'8707', 'empty'=>'8709', 'nabla'=>'8711', 'isin'=>'8712', 'notin'=>'8713', 'ni'=>'8715', 'prod'=>'8719', 'sum'=>'8721', 'minus'=>'8722', 'lowast'=>'8727', 'radic'=>'8730', 'prop'=>'8733', 'infin'=>'8734', 'ang'=>'8736', 'and'=>'8743', 'or'=>'8744', 'cap'=>'8745', 'cup'=>'8746', 'int'=>'8747', 'there4'=>'8756', 'sim'=>'8764', 'cong'=>'8773', 'asymp'=>'8776', 'ne'=>'8800', 'equiv'=>'8801', 'le'=>'8804', 'ge'=>'8805', 'sub'=>'8834', 'sup'=>'8835', 'nsub'=>'8836', 'sube'=>'8838', 'supe'=>'8839', 'oplus'=>'8853', 'otimes'=>'8855', 'perp'=>'8869', 'sdot'=>'8901', 'lceil'=>'8968', 'rceil'=>'8969', 'lfloor'=>'8970', 'rfloor'=>'8971', 'lang'=>'9001', 'rang'=>'9002', 'loz'=>'9674', 'spades'=>'9824', 'clubs'=>'9827', 'hearts'=>'9829', 'diams'=>'9830', 'apos'=>'39',  'OElig'=>'338', 'oelig'=>'339', 'Scaron'=>'352', 'scaron'=>'353', 'Yuml'=>'376', 'circ'=>'710', 'tilde'=>'732', 'ensp'=>'8194', 'emsp'=>'8195', 'thinsp'=>'8201', 'zwnj'=>'8204', 'zwj'=>'8205', 'lrm'=>'8206', 'rlm'=>'8207', 'ndash'=>'8211', 'mdash'=>'8212', 'lsquo'=>'8216', 'rsquo'=>'8217', 'sbquo'=>'8218', 'ldquo'=>'8220', 'rdquo'=>'8221', 'bdquo'=>'8222', 'dagger'=>'8224', 'Dagger'=>'8225', 'permil'=>'8240', 'lsaquo'=>'8249', 'rsaquo'=>'8250', 'euro'=>'8364', 'nbsp'=>'160', 'iexcl'=>'161', 'cent'=>'162', 'pound'=>'163', 'curren'=>'164', 'yen'=>'165', 'brvbar'=>'166', 'sect'=>'167', 'uml'=>'168', 'copy'=>'169', 'ordf'=>'170', 'laquo'=>'171', 'not'=>'172', 'shy'=>'173', 'reg'=>'174', 'macr'=>'175', 'deg'=>'176', 'plusmn'=>'177', 'sup2'=>'178', 'sup3'=>'179', 'acute'=>'180', 'micro'=>'181', 'para'=>'182', 'middot'=>'183', 'cedil'=>'184', 'sup1'=>'185', 'ordm'=>'186', 'raquo'=>'187', 'frac14'=>'188', 'frac12'=>'189', 'frac34'=>'190', 'iquest'=>'191', 'Agrave'=>'192', 'Aacute'=>'193', 'Acirc'=>'194', 'Atilde'=>'195', 'Auml'=>'196', 'Aring'=>'197', 'AElig'=>'198', 'Ccedil'=>'199', 'Egrave'=>'200', 'Eacute'=>'201', 'Ecirc'=>'202', 'Euml'=>'203', 'Igrave'=>'204', 'Iacute'=>'205', 'Icirc'=>'206', 'Iuml'=>'207', 'ETH'=>'208', 'Ntilde'=>'209', 'Ograve'=>'210', 'Oacute'=>'211', 'Ocirc'=>'212', 'Otilde'=>'213', 'Ouml'=>'214', 'times'=>'215', 'Oslash'=>'216', 'Ugrave'=>'217', 'Uacute'=>'218', 'Ucirc'=>'219', 'Uuml'=>'220', 'Yacute'=>'221', 'THORN'=>'222', 'szlig'=>'223', 'agrave'=>'224', 'aacute'=>'225', 'acirc'=>'226', 'atilde'=>'227', 'auml'=>'228', 'aring'=>'229', 'aelig'=>'230', 'ccedil'=>'231', 'egrave'=>'232', 'eacute'=>'233', 'ecirc'=>'234', 'euml'=>'235', 'igrave'=>'236', 'iacute'=>'237', 'icirc'=>'238', 'iuml'=>'239', 'eth'=>'240', 'ntilde'=>'241', 'ograve'=>'242', 'oacute'=>'243', 'ocirc'=>'244', 'otilde'=>'245', 'ouml'=>'246', 'divide'=>'247', 'oslash'=>'248', 'ugrave'=>'249', 'uacute'=>'250', 'ucirc'=>'251', 'uuml'=>'252', 'yacute'=>'253', 'thorn'=>'254', 'yuml'=>'255');
    467. 

  467. 		if($t[0] != '#'){
    468. 

  468. 			return ($C['and_mark'] ? "\x06" : '&'). (isset($U[$t]) ? $t : (isset($N[$t]) ? (!$C['named_entity'] ? '#'. ($C['hexdec_entity'] > 1 ? 'x'. dechex($N[$t]) : $N[$t]) : $t) : 'amp;'. $t)). ';';
    469. 

  469. 		}
    470. 

  470. 		if(($n = ctype_digit($t = substr($t, 1)) ? intval($t) : hexdec(substr($t, 1))) < 9 or ($n > 13 && $n < 32) or $n == 11 or $n == 12 or ($n > 126 && $n < 160 && $n != 133) or ($n > 55295 && ($n < 57344 or ($n > 64975 && $n < 64992) or $n == 65534 or $n == 65535 or $n > 1114111))){
    471. 

  471. 			return ($C['and_mark'] ? "\x06" : '&'). "amp;#{$t};";
    472. 

  472. 		}
    473. 

  473. 		return ($C['and_mark'] ? "\x06" : '&'). '#'. (((ctype_digit($t) && $C['hexdec_entity'] < 2) or !$C['hexdec_entity']) ? $n : 'x'. dechex($n)). ';';
    474. 

  474. 		// eof
    475. 

  475. 	}
    476. 

  476. 

  477. 	public static function hl_prot($p, $c=null){
    478. 

  478. 		// check URL scheme
    479. 

  479. 		$C = vmFilter::$C;
    480. 

  480. 		$b = $a = '';
    481. 

  481. 		if($c == null){
    482. 

  482. 			$c = 'style'; $b = $p[1]; $a = $p[3]; $p = trim($p[2]);
    483. 

  483. 		}
    484. 

  484. 		$c = isset($C['schemes'][$c]) ? $C['schemes'][$c] : $C['schemes']['*'];
    485. 

  485. 		static $d = 'denied:';
    486. 

  486. 		if(isset($c['!']) && substr($p, 0, 7) != $d){
    487. 

  487. 			$p = "$d$p";
    488. 

  488. 		}
    489. 

  489. 		if(isset($c['*']) or !strcspn($p, '#?;') or (substr($p, 0, 7) == $d)){
    490. 

  490. 			return "{$b}{$p}{$a}";
    491. 

  491. 		} // All ok, frag, query, param
    492. 

  492. 		if(preg_match('`^([a-z\d\-+.&#; ]+?)(:|&#(58|x3a);|%3a|\\\\0{0,4}3a).`i', $p, $m) && !isset($c[strtolower($m[1])])){
    493. 

  493. 			// Denied prot
    494. 

  494. 			return "{$b}{$d}{$p}{$a}";
    495. 

  495. 		}
    496. 

  496. 		if($C['abs_url']){
    497. 

  497. 			if($C['abs_url'] == -1 && strpos($p, $C['base_url']) === 0){
    498. 

  498. 				// Make url rel
    499. 

  499. 				$p = substr($p, strlen($C['base_url']));
    500. 

  500. 			}elseif(empty($m[1])){
    501. 

  501. 				// Make URL abs
    502. 

  502. 				if(substr($p, 0, 2) == '//'){
    503. 

  503. 					$p = substr($C['base_url'], 0, strpos($C['base_url'], ':')+1). $p;
    504. 

  504. 				}
    505. 

  505. 				elseif($p[0] == '/'){
    506. 

  506. 					$p = preg_replace('`(^.+?://[^/]+)(.*)`', '$1', $C['base_url']). $p;
    507. 

  507. 				}
    508. 

  508. 				elseif(strcspn($p, './')){
    509. 

  509. 					$p = $C['base_url']. $p;
    510. 

  510. 				}
    511. 

  511. 				else{
    512. 

  512. 					preg_match('`^([a-zA-Z\d\-+.]+://[^/]+)(.*)`', $C['base_url'], $m);
    513. 

  513. 					$p = preg_replace('`(?<=/)\./`', '', $m[2]. $p);
    514. 

  514. 					while(preg_match('`(?<=/)([^/]{3,}|[^/.]+?|\.[^/.]|[^/.]\.)/\.\./`', $p)){
    515. 

  515. 						$p = preg_replace('`(?<=/)([^/]{3,}|[^/.]+?|\.[^/.]|[^/.]\.)/\.\./`', '', $p);
    516. 

  516. 					}
    517. 

  517. 					$p = $m[1]. $p;
    518. 

  518. 				}
    519. 

  519. 			}
    520. 

  520. 		}
    521. 

  521. 		return "{$b}{$p}{$a}";
    522. 

  522. 		// eof
    523. 

  523. 	}
    524. 

  524. 

  525. 	public static function hl_regex($p){
    526. 

  526. 		// ?regex
    527. 

  527. 		if(empty($p)){
    528. 

  528. 			return 0;
    529. 

  529. 		}
    530. 

  530. 		if($t = ini_get('track_errors')){
    531. 

  531. 			$o = isset($php_errormsg) ? $php_errormsg : null;
    532. 

  532. 		}
    533. 

  533. 		else{ini_set('track_errors', 1);
    534. 

  534. 		}
    535. 

  535. 		unset($php_errormsg);
    536. 

  536. 		if(($d = ini_get('display_errors'))){
    537. 

  537. 			ini_set('display_errors', 0);
    538. 

  538. 		}
    539. 

  539. 		preg_match($p, '');
    540. 

  540. 		if($d){
    541. 

  541. 			ini_set('display_errors', 1);
    542. 

  542. 		}
    543. 

  543. 		$r = isset($php_errormsg) ? 0 : 1;
    544. 

  544. 		if($t){
    545. 

  545. 			$php_errormsg = isset($o) ? $o : null;
    546. 

  546. 		}
    547. 

  547. 		else{ini_set('track_errors', 0);
    548. 

  548. 		}
    549. 

  549. 		return $r;
    550. 

  550. 		// eof
    551. 

  551. 	}
    552. 

  552. 

  553. 	public static function hl_spec($t){
    554. 

  554. 		// final $spec
    555. 

  555. 		$s = array();
    556. 

  556. 		$t = str_replace(array("\t", "\r", "\n", ' '), '', preg_replace('/"(?>(`.|[^"])*)"/sme', 'substr(str_replace(array(";", "|", "~", " ", ",", "/", "(", ")", \'`"\'), array("\x01", "\x02", "\x03", "\x04", "\x05", "\x06", "\x07", "\x08", "\""), "$0"), 1, -1)', trim($t)));
    557. 

  557. 		for($i = count(($t = explode(';', $t))); --$i>=0;){
    558. 

  558. 			$w = $t[$i];
    559. 

  559. 			if(empty($w) or ($e = strpos($w, '=')) === false or !strlen(($a =  substr($w, $e+1)))){
    560. 

  560. 				continue;
    561. 

  561. 			}
    562. 

  562. 			$y = $n = array();
    563. 

  563. 			foreach(explode(',', $a) as $v){
    564. 

  564. 				if(!preg_match('`^([a-z:\-\*]+)(?:\((.*?)\))?`i', $v, $m)){
    565. 

  565. 					continue;
    566. 

  566. 				}
    567. 

  567. 				if(($x = strtolower($m[1])) == '-*'){
    568. 

  568. 					$n['*'] = 1; continue;
    569. 

  569. 				}
    570. 

  570. 				if($x[0] == '-'){
    571. 

  571. 					$n[substr($x, 1)] = 1; continue;
    572. 

  572. 				}
    573. 

  573. 				if(!isset($m[2])){
    574. 

  574. 					$y[$x] = 1; continue;
    575. 

  575. 				}
    576. 

  576. 				foreach(explode('/', $m[2]) as $m){
    577. 

  577. 					if(empty($m) or ($p = strpos($m, '=')) == 0 or $p < 5){
    578. 

  578. 						$y[$x] = 1; continue;
    579. 

  579. 					}
    580. 

  580. 					$y[$x][strtolower(substr($m, 0, $p))] = str_replace(array("\x01", "\x02", "\x03", "\x04", "\x05", "\x06", "\x07", "\x08"), array(";", "|", "~", " ", ",", "/", "(", ")"), substr($m, $p+1));
    581. 

  581. 				}
    582. 

  582. 				if(isset($y[$x]['match']) && !vmFilter::hl_regex($y[$x]['match'])){
    583. 

  583. 					unset($y[$x]['match']);
    584. 

  584. 				}
    585. 

  585. 				if(isset($y[$x]['nomatch']) && !vmFilter::hl_regex($y[$x]['nomatch'])){
    586. 

  586. 					unset($y[$x]['nomatch']);
    587. 

  587. 				}
    588. 

  588. 			}
    589. 

  589. 			if(!count($y) && !count($n)){
    590. 

  590. 				continue;
    591. 

  591. 			}
    592. 

  592. 			foreach(explode(',', substr($w, 0, $e)) as $v){
    593. 

  593. 				if(!strlen(($v = strtolower($v)))){
    594. 

  594. 					continue;
    595. 

  595. 				}
    596. 

  596. 				if(count($y)){
    597. 

  597. 					$s[$v] = $y;
    598. 

  598. 				}
    599. 

  599. 				if(count($n)){
    600. 

  600. 					$s[$v]['n'] = $n;
    601. 

  601. 				}
    602. 

  602. 			}
    603. 

  603. 		}
    604. 

  604. 		return $s;
    605. 

  605. 		// eof
    606. 

  606. 	}
    607. 

  607. 

  608. 	public static function hl_tag($t){
    609. 

  609. 		// tag/attribute handler
    610. 

  610. 		$C = vmFilter::$C;
    611. 

  611. 		$t = $t[0];
    612. 

  612. 		// invalid < >
    613. 

  613. 		if($t == '< '){
    614. 

  614. 			return '&lt; ';
    615. 

  615. 		}
    616. 

  616. 		if($t == '>'){
    617. 

  617. 			return '&gt;';
    618. 

  618. 		}
    619. 

  619. 		if(!preg_match('`^<(/?)([a-zA-Z][a-zA-Z1-6]*)([^>]*?)\s?>$`m', $t, $m)){
    620. 

  620. 			return str_replace(array('<', '>'), array('&lt;', '&gt;'), $t);
    621. 

  621. 		}elseif(!isset($C['elements'][($e = strtolower($m[2]))])){
    622. 

  622. 			return (($C['keep_bad']%2) ? str_replace(array('<', '>'), array('&lt;', '&gt;'), $t) : '');
    623. 

  623. 		}
    624. 

  624. 		// attr string
    625. 

  625. 		$a = str_replace(array("\n", "\r", "\t"), ' ', trim($m[3]));
    626. 

  626. 		// tag transform
    627. 

  627. 		static $eD = array('applet'=>1, 'center'=>1, 'dir'=>1, 'embed'=>1, 'font'=>1, 'isindex'=>1, 'menu'=>1, 's'=>1, 'strike'=>1, 'u'=>1); // Deprecated
    628. 

  628. 		if($C['make_tag_strict'] && isset($eD[$e])){
    629. 

  629. 			$trt = vmFilter::hl_tag2($e, $a, $C['make_tag_strict']);
    630. 

  630. 			if(!$e){
    631. 

  631. 				return (($C['keep_bad']%2) ? str_replace(array('<', '>'), array('&lt;', '&gt;'), $t) : '');
    632. 

  632. 			}
    633. 

  633. 		}
    634. 

  634. 		// close tag
    635. 

  635. 		static $eE = array('area'=>1, 'br'=>1, 'col'=>1, 'embed'=>1, 'hr'=>1, 'img'=>1, 'input'=>1, 'isindex'=>1, 'param'=>1); // Empty ele
    636. 

  636. 		if(!empty($m[1])){
    637. 

  637. 			return (!isset($eE[$e]) ? "</$e>" : (($C['keep_bad'])%2 ? str_replace(array('<', '>'), array('&lt;', '&gt;'), $t) : ''));
    638. 

  638. 		}
    639. 

  639. 

  640. 		// open tag & attr
    641. 

  641. 		static $aN = array('abbr'=>array('td'=>1, 'th'=>1), 'accept-charset'=>array('form'=>1), 'accept'=>array('form'=>1, 'input'=>1), 'accesskey'=>array('a'=>1, 'area'=>1, 'button'=>1, 'input'=>1, 'label'=>1, 'legend'=>1, 'textarea'=>1), 'action'=>array('form'=>1), 'align'=>array('caption'=>1, 'embed'=>1, 'applet'=>1, 'iframe'=>1, 'img'=>1, 'input'=>1, 'object'=>1, 'legend'=>1, 'table'=>1, 'hr'=>1, 'div'=>1, 'h1'=>1, 'h2'=>1, 'h3'=>1, 'h4'=>1, 'h5'=>1, 'h6'=>1, 'p'=>1, 'col'=>1, 'colgroup'=>1, 'tbody'=>1, 'td'=>1, 'tfoot'=>1, 'th'=>1, 'thead'=>1, 'tr'=>1), 'alt'=>array('applet'=>1, 'area'=>1, 'img'=>1, 'input'=>1), 'archive'=>array('applet'=>1, 'object'=>1), 'axis'=>array('td'=>1, 'th'=>1), 'bgcolor'=>array('embed'=>1, 'table'=>1, 'tr'=>1, 'td'=>1, 'th'=>1), 'border'=>array('table'=>1, 'img'=>1, 'object'=>1), 'bordercolor'=>array('table'=>1, 'td'=>1, 'tr'=>1), 'cellpadding'=>array('table'=>1), 'cellspacing'=>array('table'=>1), 'char'=>array('col'=>1, 'colgroup'=>1, 'tbody'=>1, 'td'=>1, 'tfoot'=>1, 'th'=>1, 'thead'=>1, 'tr'=>1), 'charoff'=>array('col'=>1, 'colgroup'=>1, 'tbody'=>1, 'td'=>1, 'tfoot'=>1, 'th'=>1, 'thead'=>1, 'tr'=>1), 'charset'=>array('a'=>1, 'script'=>1), 'checked'=>array('input'=>1), 'cite'=>array('blockquote'=>1, 'q'=>1, 'del'=>1, 'ins'=>1), 'classid'=>array('object'=>1), 'clear'=>array('br'=>1), 'code'=>array('applet'=>1), 'codebase'=>array('object'=>1, 'applet'=>1), 'codetype'=>array('object'=>1), 'color'=>array('font'=>1), 'cols'=>array('textarea'=>1), 'colspan'=>array('td'=>1, 'th'=>1), 'compact'=>array('dir'=>1, 'dl'=>1, 'menu'=>1, 'ol'=>1, 'ul'=>1), 'coords'=>array('area'=>1, 'a'=>1), 'data'=>array('object'=>1), 'datetime'=>array('del'=>1, 'ins'=>1), 'declare'=>array('object'=>1), 'defer'=>array('script'=>1), 'dir'=>array('bdo'=>1), 'disabled'=>array('button'=>1, 'input'=>1, 'optgroup'=>1, 'option'=>1, 'select'=>1, 'textarea'=>1), 'enctype'=>array('form'=>1), 'face'=>array('font'=>1), 'for'=>array('label'=>1), 'frame'=>array('table'=>1), 'frameborder'=>array('iframe'=>1), 'headers'=>array('td'=>1, 'th'=>1), 'height'=>array('embed'=>1, 'iframe'=>1, 'td'=>1, 'th'=>1, 'img'=>1, 'object'=>1, 'applet'=>1), 'href'=>array('a'=>1, 'area'=>1), 'hreflang'=>array('a'=>1), 'hspace'=>array('applet'=>1, 'img'=>1, 'object'=>1), 'ismap'=>array('img'=>1, 'input'=>1), 'label'=>array('option'=>1, 'optgroup'=>1), 'language'=>array('script'=>1), 'longdesc'=>array('img'=>1, 'iframe'=>1), 'marginheight'=>array('iframe'=>1), 'marginwidth'=>array('iframe'=>1), 'maxlength'=>array('input'=>1), 'method'=>array('form'=>1), 'model'=>array('embed'=>1), 'multiple'=>array('select'=>1), 'name'=>array('button'=>1, 'embed'=>1, 'textarea'=>1, 'applet'=>1, 'select'=>1, 'form'=>1, 'iframe'=>1, 'img'=>1, 'a'=>1, 'input'=>1, 'object'=>1, 'map'=>1, 'param'=>1), 'nohref'=>array('area'=>1), 'noshade'=>array('hr'=>1), 'nowrap'=>array('td'=>1, 'th'=>1), 'object'=>array('applet'=>1), 'onblur'=>array('a'=>1, 'area'=>1, 'button'=>1, 'input'=>1, 'label'=>1, 'select'=>1, 'textarea'=>1), 'onchange'=>array('input'=>1, 'select'=>1, 'textarea'=>1), 'onfocus'=>array('a'=>1, 'area'=>1, 'button'=>1, 'input'=>1, 'label'=>1, 'select'=>1, 'textarea'=>1), 'onreset'=>array('form'=>1), 'onselect'=>array('input'=>1, 'textarea'=>1), 'onsubmit'=>array('form'=>1), 'pluginspage'=>array('embed'=>1), 'pluginurl'=>array('embed'=>1), 'prompt'=>array('isindex'=>1), 'readonly'=>array('textarea'=>1, 'input'=>1), 'rel'=>array('a'=>1), 'rev'=>array('a'=>1), 'rows'=>array('textarea'=>1), 'rowspan'=>array('td'=>1, 'th'=>1), 'rules'=>array('table'=>1), 'scope'=>array('td'=>1, 'th'=>1), 'scrolling'=>array('iframe'=>1), 'selected'=>array('option'=>1), 'shape'=>array('area'=>1, 'a'=>1), 'size'=>array('hr'=>1, 'font'=>1, 'input'=>1, 'select'=>1), 'span'=>array('col'=>1, 'colgroup'=>1), 'src'=>array('embed'=>1, 'script'=>1, 'input'=>1, 'iframe'=>1, 'img'=>1), 'standby'=>array('object'=>1), 'start'=>array('ol'=>1), 'summary'=>array('table'=>1), 'tabindex'=>array('a'=>1, 'area'=>1, 'button'=>1, 'input'=>1, 'object'=>1, 'select'=>1, 'textarea'=>1), 'target'=>array('a'=>1, 'area'=>1, 'form'=>1), 'type'=>array('a'=>1, 'embed'=>1, 'object'=>1, 'param'=>1, 'script'=>1, 'input'=>1, 'li'=>1, 'ol'=>1, 'ul'=>1, 'button'=>1), 'usemap'=>array('img'=>1, 'input'=>1, 'object'=>1), 'valign'=>array('col'=>1, 'colgroup'=>1, 'tbody'=>1, 'td'=>1, 'tfoot'=>1, 'th'=>1, 'thead'=>1, 'tr'=>1), 'value'=>array('input'=>1, 'option'=>1, 'param'=>1, 'button'=>1, 'li'=>1), 'valuetype'=>array('param'=>1), 'vspace'=>array('applet'=>1, 'img'=>1, 'object'=>1), 'width'=>array('embed'=>1, 'hr'=>1, 'iframe'=>1, 'img'=>1, 'object'=>1, 'table'=>1, 'td'=>1, 'th'=>1, 'applet'=>1, 'col'=>1, 'colgroup'=>1, 'pre'=>1), 'wmode'=>array('embed'=>1), 'xml:space'=>array('pre'=>1, 'script'=>1, 'style'=>1)); // Ele-specific
    642. 

  642. 		static $aNE = array('checked'=>1, 'compact'=>1, 'declare'=>1, 'defer'=>1, 'disabled'=>1, 'ismap'=>1, 'multiple'=>1, 'nohref'=>1, 'noresize'=>1, 'noshade'=>1, 'nowrap'=>1, 'readonly'=>1, 'selected'=>1); // Empty
    643. 

  643. 		static $aNP = array('action'=>1, 'cite'=>1, 'classid'=>1, 'codebase'=>1, 'data'=>1, 'href'=>1, 'longdesc'=>1, 'model'=>1, 'pluginspage'=>1, 'pluginurl'=>1, 'usemap'=>1); // Need scheme check; excludes style, on* & src
    644. 

  644. 		static $aNU = array('class'=>array('param'=>1, 'script'=>1), 'dir'=>array('applet'=>1, 'bdo'=>1, 'br'=>1, 'iframe'=>1, 'param'=>1, 'script'=>1), 'id'=>array('script'=>1), 'lang'=>array('applet'=>1, 'br'=>1, 'iframe'=>1, 'param'=>1, 'script'=>1), 'xml:lang'=>array('applet'=>1, 'br'=>1, 'iframe'=>1, 'param'=>1, 'script'=>1), 'onclick'=>array('applet'=>1, 'bdo'=>1, 'br'=>1, 'font'=>1, 'iframe'=>1, 'isindex'=>1, 'param'=>1, 'script'=>1), 'ondblclick'=>array('applet'=>1, 'bdo'=>1, 'br'=>1, 'font'=>1, 'iframe'=>1, 'isindex'=>1, 'param'=>1, 'script'=>1), 'onkeydown'=>array('applet'=>1, 'bdo'=>1, 'br'=>1, 'font'=>1, 'iframe'=>1, 'isindex'=>1, 'param'=>1, 'script'=>1), 'onkeypress'=>array('applet'=>1, 'bdo'=>1, 'br'=>1, 'font'=>1, 'iframe'=>1, 'isindex'=>1, 'param'=>1, 'script'=>1), 'onkeyup'=>array('applet'=>1, 'bdo'=>1, 'br'=>1, 'font'=>1, 'iframe'=>1, 'isindex'=>1, 'param'=>1, 'script'=>1), 'onmousedown'=>array('applet'=>1, 'bdo'=>1, 'br'=>1, 'font'=>1, 'iframe'=>1, 'isindex'=>1, 'param'=>1, 'script'=>1), 'onmousemove'=>array('applet'=>1, 'bdo'=>1, 'br'=>1, 'font'=>1, 'iframe'=>1, 'isindex'=>1, 'param'=>1, 'script'=>1), 'onmouseout'=>array('applet'=>1, 'bdo'=>1, 'br'=>1, 'font'=>1, 'iframe'=>1, 'isindex'=>1, 'param'=>1, 'script'=>1), 'onmouseover'=>array('applet'=>1, 'bdo'=>1, 'br'=>1, 'font'=>1, 'iframe'=>1, 'isindex'=>1, 'param'=>1, 'script'=>1), 'onmouseup'=>array('applet'=>1, 'bdo'=>1, 'br'=>1, 'font'=>1, 'iframe'=>1, 'isindex'=>1, 'param'=>1, 'script'=>1), 'style'=>array('param'=>1, 'script'=>1), 'title'=>array('param'=>1, 'script'=>1)); // Univ & exceptions
    645. 

  645. 

  646. 		if($C['lc_std_val']){
    647. 

  647. 			// predef attr vals for $eAL & $aNE ele
    648. 

  648. 			static $aNL = array('all'=>1, 'baseline'=>1, 'bottom'=>1, 'button'=>1, 'center'=>1, 'char'=>1, 'checkbox'=>1, 'circle'=>1, 'col'=>1, 'colgroup'=>1, 'cols'=>1, 'data'=>1, 'default'=>1, 'file'=>1, 'get'=>1, 'groups'=>1, 'hidden'=>1, 'image'=>1, 'justify'=>1, 'left'=>1, 'ltr'=>1, 'middle'=>1, 'none'=>1, 'object'=>1, 'password'=>1, 'poly'=>1, 'post'=>1, 'preserve'=>1, 'radio'=>1, 'rect'=>1, 'ref'=>1, 'reset'=>1, 'right'=>1, 'row'=>1, 'rowgroup'=>1, 'rows'=>1, 'rtl'=>1, 'submit'=>1, 'text'=>1, 'top'=>1);
    649. 

  649. 			static $eAL = array('a'=>1, 'area'=>1, 'bdo'=>1, 'button'=>1, 'col'=>1, 'form'=>1, 'img'=>1, 'input'=>1, 'object'=>1, 'optgroup'=>1, 'option'=>1, 'param'=>1, 'script'=>1, 'select'=>1, 'table'=>1, 'td'=>1, 'tfoot'=>1, 'th'=>1, 'thead'=>1, 'tr'=>1, 'xml:space'=>1);
    650. 

  650. 			$lcase = isset($eAL[$e]) ? 1 : 0;
    651. 

  651. 		}
    652. 

  652. 

  653. 		$depTr = 0;
    654. 

  654. 		if($C['no_deprecated_attr']){
    655. 

  655. 			// dep attr:applicable ele
    656. 

  656. 			static $aND = array('align'=>array('caption'=>1, 'div'=>1, 'h1'=>1, 'h2'=>1, 'h3'=>1, 'h4'=>1, 'h5'=>1, 'h6'=>1, 'hr'=>1, 'img'=>1, 'input'=>1, 'legend'=>1, 'object'=>1, 'p'=>1, 'table'=>1), 'bgcolor'=>array('table'=>1, 'td'=>1, 'th'=>1, 'tr'=>1), 'border'=>array('img'=>1, 'object'=>1), 'bordercolor'=>array('table'=>1, 'td'=>1, 'tr'=>1), 'clear'=>array('br'=>1), 'compact'=>array('dl'=>1, 'ol'=>1, 'ul'=>1), 'height'=>array('td'=>1, 'th'=>1), 'hspace'=>array('img'=>1, 'object'=>1), 'language'=>array('script'=>1), 'name'=>array('a'=>1, 'form'=>1, 'iframe'=>1, 'img'=>1, 'map'=>1), 'noshade'=>array('hr'=>1), 'nowrap'=>array('td'=>1, 'th'=>1), 'size'=>array('hr'=>1), 'start'=>array('ol'=>1), 'type'=>array('li'=>1, 'ol'=>1, 'ul'=>1), 'value'=>array('li'=>1), 'vspace'=>array('img'=>1, 'object'=>1), 'width'=>array('hr'=>1, 'pre'=>1, 'td'=>1, 'th'=>1));
    657. 

  657. 			static $eAD = array('a'=>1, 'br'=>1, 'caption'=>1, 'div'=>1, 'dl'=>1, 'form'=>1, 'h1'=>1, 'h2'=>1, 'h3'=>1, 'h4'=>1, 'h5'=>1, 'h6'=>1, 'hr'=>1, 'iframe'=>1, 'img'=>1, 'input'=>1, 'legend'=>1, 'li'=>1, 'map'=>1, 'object'=>1, 'ol'=>1, 'p'=>1, 'pre'=>1, 'script'=>1, 'table'=>1, 'td'=>1, 'th'=>1, 'tr'=>1, 'ul'=>1);
    658. 

  658. 			$depTr = isset($eAD[$e]) ? 1 : 0;
    659. 

  659. 		}
    660. 

  660. 

  661. 		// attr name-vals
    662. 

  662. 		if(strpos($a, "\x01") !== false){
    663. 

  663. 			$a = preg_replace('`\x01[^\x01]*\x01`', '', $a);
    664. 

  664. 		} // No comment/CDATA sec
    665. 

  665. 		$mode = 0; $a = trim($a, ' /'); $aA = array();
    666. 

  666. 		while(strlen($a)){
    667. 

  667. 			$w = 0;
    668. 

  668. 			switch($mode){
    669. 

  669. 				case 0: // Name
    670. 

  670. 					if(preg_match('`^[a-zA-Z][\-a-zA-Z:]+`', $a, $m)){
    671. 

  671. 						$nm = strtolower($m[0]);
    672. 

  672. 						$w = $mode = 1; $a = ltrim(substr_replace($a, '', 0, strlen($m[0])));
    673. 

  673. 					}
    674. 

  674. 					break; case 1:
    675. 

  675. 						if($a[0] == '='){
    676. 

  676. 							// =
    677. 

  677. 							$w = 1; $mode = 2; $a = ltrim($a, '= ');
    678. 

  678. 						}else{ // No val
    679. 

  679. 							$w = 1; $mode = 0; $a = ltrim($a);
    680. 

  680. 							$aA[$nm] = '';
    681. 

  681. 						}
    682. 

  682. 						break; case 2: // Val
    683. 

  683. 							if(preg_match('`^"[^"]*"`', $a, $m) or preg_match("`^'[^']*'`", $a, $m) or preg_match("`^\s*[^\s\"']+`", $a, $m)){
    684. 

  684. 								$m = $m[0]; $w = 1; $mode = 0; $a = ltrim(substr_replace($a, '', 0, strlen($m)));
    685. 

  685. 								$aA[$nm] = trim(($m[0] == '"' or $m[0] == '\'') ? substr($m, 1, -1) : $m);
    686. 

  686. 							}
    687. 

  687. 							break;
    688. 

  688. 			}
    689. 

  689. 			if($w == 0){
    690. 

  690. 				// Parse errs, deal with space, " & '
    691. 

  691. 				$a = preg_replace('`^(?:"[^"]*("|$)|\'[^\']*(\'|$)|\S)*\s*`', '', $a);
    692. 

  692. 				$mode = 0;
    693. 

  693. 			}
    694. 

  694. 		}
    695. 

  695. 		if($mode == 1){
    696. 

  696. 			$aA[$nm] = '';
    697. 

  697. 		}
    698. 

  698. 

  699. 		// clean attrs
    700. 

  700. 		$S = vmFilter::$S;
    701. 

  701. 		$rl = isset($S[$e]) ? $S[$e] : array();
    702. 

  702. 		$a = array(); $nfr = 0;
    703. 

  703. 		foreach($aA as $k=>$v){
    704. 

  704. 			if(((isset($C['deny_attribute']['*']) ? isset($C['deny_attribute'][$k]) : !isset($C['deny_attribute'][$k])) or isset($rl[$k])) && ((!isset($rl['n'][$k]) && !isset($rl['n']['*'])) or isset($rl[$k])) && (isset($aN[$k][$e]) or (isset($aNU[$k]) && !isset($aNU[$k][$e])))){
    705. 

  705. 				if(isset($aNE[$k])){
    706. 

  706. 					$v = $k;
    707. 

  707. 				}
    708. 

  708. 				elseif(!empty($lcase) && (($e != 'button' or $e != 'input') or $k == 'type')){
    709. 

  709. 					// Rather loose but ?not cause issues
    710. 

  710. 					$v = (isset($aNL[($v2 = strtolower($v))])) ? $v2 : $v;
    711. 

  711. 				}
    712. 

  712. 				if($k == 'style' && !$C['style_pass']){
    713. 

  713. 					if(false !== strpos($v, '&#')){
    714. 

  714. 						static $sC = array('&#x20;'=>' ', '&#32;'=>' ', '&#x45;'=>'e', '&#69;'=>'e', '&#x65;'=>'e', '&#101;'=>'e', '&#x58;'=>'x', '&#88;'=>'x', '&#x78;'=>'x', '&#120;'=>'x', '&#x50;'=>'p', '&#80;'=>'p', '&#x70;'=>'p', '&#112;'=>'p', '&#x53;'=>'s', '&#83;'=>'s', '&#x73;'=>'s', '&#115;'=>'s', '&#x49;'=>'i', '&#73;'=>'i', '&#x69;'=>'i', '&#105;'=>'i', '&#x4f;'=>'o', '&#79;'=>'o', '&#x6f;'=>'o', '&#111;'=>'o', '&#x4e;'=>'n', '&#78;'=>'n', '&#x6e;'=>'n', '&#110;'=>'n', '&#x55;'=>'u', '&#85;'=>'u', '&#x75;'=>'u', '&#117;'=>'u', '&#x52;'=>'r', '&#82;'=>'r', '&#x72;'=>'r', '&#114;'=>'r', '&#x4c;'=>'l', '&#76;'=>'l', '&#x6c;'=>'l', '&#108;'=>'l', '&#x28;'=>'(', '&#40;'=>'(', '&#x29;'=>')', '&#41;'=>')', '&#x20;'=>':', '&#32;'=>':', '&#x22;'=>'"', '&#34;'=>'"', '&#x27;'=>"'", '&#39;'=>"'", '&#x2f;'=>'/', '&#47;'=>'/', '&#x2a;'=>'*', '&#42;'=>'*', '&#x5c;'=>'\\', '&#92;'=>'\\');
    715. 

  715. 						$v = strtr($v, $sC);
    716. 

  716. 					}
    717. 

  717. 					$v = preg_replace_callback('`(url(?:\()(?: )*(?:\'|"|&(?:quot|apos);)?)(.+?)((?:\'|"|&(?:quot|apos);)?(?: )*(?:\)))`iS', 'vmFilter::hl_prot', $v);
    718. 

  718. 					$v = !$C['css_expression'] ? preg_replace('`expression`i', ' ', preg_replace('`\\\\\S|(/|(%2f))(\*|(%2a))`i', ' ', $v)) : $v;
    719. 

  719. 				}elseif(isset($aNP[$k]) or strpos($k, 'src') !== false or $k[0] == 'o'){
    720. 

  720. 					$v = str_replace("\xad", ' ', (strpos($v, '&') !== false ? str_replace(array('&#xad;', '&#173;', '&shy;'), ' ', $v) : $v));
    721. 

  721. 					$v = vmFilter::hl_prot($v, $k);
    722. 

  722. 					if($k == 'href'){
    723. 

  723. 						// X-spam
    724. 

  724. 						if($C['anti_mail_spam'] && strpos($v, 'mailto:') === 0){
    725. 

  725. 							$v = str_replace('@', htmlspecialchars($C['anti_mail_spam']), $v);
    726. 

  726. 						}elseif($C['anti_link_spam']){
    727. 

  727. 							$r1 = $C['anti_link_spam'][1];
    728. 

  728. 							if(!empty($r1) && preg_match($r1, $v)){
    729. 

  729. 								continue;
    730. 

  730. 							}
    731. 

  731. 							$r0 = $C['anti_link_spam'][0];
    732. 

  732. 							if(!empty($r0) && preg_match($r0, $v)){
    733. 

  733. 								if(isset($a['rel'])){
    734. 

  734. 									if(!preg_match('`\bnofollow\b`i', $a['rel'])){
    735. 

  735. 										$a['rel'] .= ' nofollow';
    736. 

  736. 									}
    737. 

  737. 								}elseif(isset($aA['rel'])){
    738. 

  738. 									if(!preg_match('`\bnofollow\b`i', $aA['rel'])){
    739. 

  739. 										$nfr = 1;
    740. 

  740. 									}
    741. 

  741. 								}else{$a['rel'] = 'nofollow';
    742. 

  742. 								}
    743. 

  743. 							}
    744. 

  744. 						}
    745. 

  745. 					}
    746. 

  746. 				}
    747. 

  747. 				if(isset($rl[$k]) && is_array($rl[$k]) && ($v = vmFilter::hl_attrval($v, $rl[$k])) === 0){
    748. 

  748. 					continue;
    749. 

  749. 				}
    750. 

  750. 				$a[$k] = str_replace('"', '&quot;', $v);
    751. 

  751. 			}
    752. 

  752. 		}
    753. 

  753. 		if($nfr){
    754. 

  754. 			$a['rel'] = isset($a['rel']) ? $a['rel']. ' nofollow' : 'nofollow';
    755. 

  755. 		}
    756. 

  756. 

  757. 		// rqd attr
    758. 

  758. 		static $eAR = array('area'=>array('alt'=>'area'), 'bdo'=>array('dir'=>'ltr'), 'form'=>array('action'=>''), 'img'=>array('src'=>'', 'alt'=>'image'), 'map'=>array('name'=>''), 'optgroup'=>array('label'=>''), 'param'=>array('name'=>''), 'script'=>array('type'=>'text/javascript'), 'textarea'=>array('rows'=>'10', 'cols'=>'50'));
    759. 

  759. 		if(isset($eAR[$e])){
    760. 

  760. 			foreach($eAR[$e] as $k=>$v){
    761. 

  761. 				if(!isset($a[$k])){
    762. 

  762. 					$a[$k] = isset($v[0]) ? $v : $k;
    763. 

  763. 				}
    764. 

  764. 			}
    765. 

  765. 		}
    766. 

  766. 

  767. 		// depr attrs
    768. 

  768. 		if($depTr){
    769. 

  769. 			$c = array();
    770. 

  770. 			foreach($a as $k=>$v){
    771. 

  771. 				if($k == 'style' or !isset($aND[$k][$e])){
    772. 

  772. 					continue;
    773. 

  773. 				}
    774. 

  774. 				if($k == 'align'){
    775. 

  775. 					unset($a['align']);
    776. 

  776. 					if($e == 'img' && ($v == 'left' or $v == 'right')){
    777. 

  777. 						$c[] = 'float: '. $v;
    778. 

  778. 					}
    779. 

  779. 					elseif(($e == 'div' or $e == 'table') && $v == 'center'){
    780. 

  780. 						$c[] = 'margin: auto';
    781. 

  781. 					}
    782. 

  782. 					else{$c[] = 'text-align: '. $v;
    783. 

  783. 					}
    784. 

  784. 				}elseif($k == 'bgcolor'){
    785. 

  785. 					unset($a['bgcolor']);
    786. 

  786. 					$c[] = 'background-color: '. $v;
    787. 

  787. 				}elseif($k == 'border'){
    788. 

  788. 					unset($a['border']); $c[] = "border: {$v}px";
    789. 

  789. 				}elseif($k == 'bordercolor'){
    790. 

  790. 					unset($a['bordercolor']); $c[] = 'border-color: '. $v;
    791. 

  791. 				}elseif($k == 'clear'){
    792. 

  792. 					unset($a['clear']); $c[] = 'clear: '. ($v != 'all' ? $v : 'both');
    793. 

  793. 				}elseif($k == 'compact'){
    794. 

  794. 					unset($a['compact']); $c[] = 'font-size: 85%';
    795. 

  795. 				}elseif($k == 'height' or $k == 'width'){
    796. 

  796. 					unset($a[$k]); $c[] = $k. ': '. ($v[0] != '*' ? $v. (ctype_digit($v) ? 'px' : '') : 'auto');
    797. 

  797. 				}elseif($k == 'hspace'){
    798. 

  798. 					unset($a['hspace']); $c[] = "margin-left: {$v}px; margin-right: {$v}px";
    799. 

  799. 				}elseif($k == 'language' && !isset($a['type'])){
    800. 

  800. 					unset($a['language']);
    801. 

  801. 					$a['type'] = 'text/'. strtolower($v);
    802. 

  802. 				}elseif($k == 'name'){
    803. 

  803. 					if($C['no_deprecated_attr'] == 2 or ($e != 'a' && $e != 'map')){
    804. 

  804. 						unset($a['name']);
    805. 

  805. 					}
    806. 

  806. 					if(!isset($a['id']) && preg_match('`[a-zA-Z][a-zA-Z\d.:_\-]*`', $v)){
    807. 

  807. 						$a['id'] = $v;
    808. 

  808. 					}
    809. 

  809. 				}elseif($k == 'noshade'){
    810. 

  810. 					unset($a['noshade']); $c[] = 'border-style: none; border: 0; background-color: gray; color: gray';
    811. 

  811. 				}elseif($k == 'nowrap'){
    812. 

  812. 					unset($a['nowrap']); $c[] = 'white-space: nowrap';
    813. 

  813. 				}elseif($k == 'size'){
    814. 

  814. 					unset($a['size']); $c[] = 'size: '. $v. 'px';
    815. 

  815. 				}elseif($k == 'start' or $k == 'value'){
    816. 

  816. 					unset($a[$k]);
    817. 

  817. 				}elseif($k == 'type'){
    818. 

  818. 					unset($a['type']);
    819. 

  819. 					static $ol_type = array('i'=>'lower-roman', 'I'=>'upper-roman', 'a'=>'lower-latin', 'A'=>'upper-latin', '1'=>'decimal');
    820. 

  820. 					$c[] = 'list-style-type: '. (isset($ol_type[$v]) ? $ol_type[$v] : 'decimal');
    821. 

  821. 				}elseif($k == 'vspace'){
    822. 

  822. 					unset($a['vspace']); $c[] = "margin-top: {$v}px; margin-bottom: {$v}px";
    823. 

  823. 				}
    824. 

  824. 			}
    825. 

  825. 			if(count($c)){
    826. 

  826. 				$c = implode('; ', $c);
    827. 

  827. 				$a['style'] = isset($a['style']) ? rtrim($a['style'], ' ;'). '; '. $c. ';': $c. ';';
    828. 

  828. 			}
    829. 

  829. 		}
    830. 

  830. 		// unique ID
    831. 

  831. 		if($C['unique_ids'] && isset($a['id'])){
    832. 

  832. 			if(!preg_match('`^[A-Za-z][A-Za-z0-9_\-.:]*$`', ($id = $a['id'])) or (!is_null(vmFilter::$hl_Ids[$id]) && $C['unique_ids'] == 1)){
    833. 

  833. 				unset($a['id']);
    834. 

  834. 			}else{
    835. 

  835. 				while(!is_null(vmFilter::$hl_Ids[$id])){
    836. 

  836. 					$id = $C['unique_ids']. $id;
    837. 

  837. 				}
    838. 

  838. 				vmFilter::$hl_Ids[($a['id'] = $id)] = 1;
    839. 

  839. 			}
    840. 

  840. 		}
    841. 

  841. 		// xml:lang
    842. 

  842. 		if($C['xml:lang'] && isset($a['lang'])){
    843. 

  843. 			$a['xml:lang'] = isset($a['xml:lang']) ? $a['xml:lang'] : $a['lang'];
    844. 

  844. 			if($C['xml:lang'] == 2){
    845. 

  845. 				unset($a['lang']);
    846. 

  846. 			}
    847. 

  847. 		}
    848. 

  848. 		// for transformed tag
    849. 

  849. 		if(!empty($trt)){
    850. 

  850. 			$a['style'] = isset($a['style']) ? rtrim($a['style'], ' ;'). '; '. $trt : $trt;
    851. 

  851. 		}
    852. 

  852. 		// return with empty ele /
    853. 

  853. 		if(empty($C['hook_tag'])){
    854. 

  854. 			$aA = '';
    855. 

  855. 			foreach($a as $k=>$v){
    856. 

  856. 				$aA .= " {$k}=\"{$v}\"";
    857. 

  857. 			}
    858. 

  858. 			return "<{$e}{$aA}". (isset($eE[$e]) ? ' /' : ''). '>';
    859. 

  859. 		}
    860. 

  860. 		else{return $C['hook_tag']($e, $a);
    861. 

  861. 		}
    862. 

  862. 		// eof
    863. 

  863. 	}
    864. 

  864. 

  865. 	public static function hl_tag2(&$e, &$a, $t=1){
    866. 

  866. 		// transform tag
    867. 

  867. 		if($e == 'center'){
    868. 

  868. 			$e = 'div'; return 'text-align: center;';
    869. 

  869. 		}
    870. 

  870. 		if($e == 'dir' or $e == 'menu'){
    871. 

  871. 			$e = 'ul'; return '';
    872. 

  872. 		}
    873. 

  873. 		if($e == 's' or $e == 'strike'){
    874. 

  874. 			$e = 'span'; return 'text-decoration: line-through;';
    875. 

  875. 		}
    876. 

  876. 		if($e == 'u'){
    877. 

  877. 			$e = 'span'; return 'text-decoration: underline;';
    878. 

  878. 		}
    879. 

  879. 		static $fs = array('0'=>'xx-small', '1'=>'xx-small', '2'=>'small', '3'=>'medium', '4'=>'large', '5'=>'x-large', '6'=>'xx-large', '7'=>'300%', '-1'=>'smaller', '-2'=>'60%', '+1'=>'larger', '+2'=>'150%', '+3'=>'200%', '+4'=>'300%');
    880. 

  880. 		if($e == 'font'){
    881. 

  881. 			$a2 = '';
    882. 

  882. 			if(preg_match('`face\s*=\s*(\'|")([^=]+?)\\1`i', $a, $m) or preg_match('`face\s*=\s*([^"])(\S+)`i', $a, $m)){
    883. 

  883. 				$a2 .= ' font-family: '. str_replace('"', '\'', trim($m[2])). ';';
    884. 

  884. 			}
    885. 

  885. 			if(preg_match('`color\s*=\s*(\'|")?(.+?)(\\1|\s|$)`i', $a, $m)){
    886. 

  886. 				$a2 .= ' color: '. trim($m[2]). ';';
    887. 

  887. 			}
    888. 

  888. 			if(preg_match('`size\s*=\s*(\'|")?(.+?)(\\1|\s|$)`i', $a, $m) && isset($fs[($m = trim($m[2]))])){
    889. 

  889. 				$a2 .= ' font-size: '. $fs[$m]. ';';
    890. 

  890. 			}
    891. 

  891. 			$e = 'span'; return ltrim($a2);
    892. 

  892. 		}
    893. 

  893. 		if($t == 2){
    894. 

  894. 			$e = 0; return 0;
    895. 

  895. 		}
    896. 

  896. 		return '';
    897. 

  897. 		// eof
    898. 

  898. 	}
    899. 

  899. 

  900. 	public static function hl_tidy($t, $w, $p){
    901. 

  901. 		// Tidy/compact HTM
    902. 

  902. 		if(strpos(' pre,script,textarea', "$p,")){
    903. 

  903. 			return $t;
    904. 

  904. 		}
    905. 

  905. 		$t = str_replace(' </', '</', preg_replace(array('`(<\w[^>]*(?<!/)>)\s+`', '`\s+`', '`(<\w[^>]*(?<!/)>) `'), array(' $1', ' ', '$1'), preg_replace_callback(array('`(<(!\[CDATA\[))(.+?)(\]\]>)`sm', '`(<(!--))(.+?)(-->)`sm', '`(<(pre|script|textarea)[^>]*?>)(.+?)(</\2>)`sm'), create_function('$m', 'return $m[1]. str_replace(array("<", ">", "\n", "\r", "\t", " "), array("\x01", "\x02", "\x03", "\x04", "\x05", "\x07"), $m[3]). $m[4];'), $t)));
    906. 

  906. 		if(($w = strtolower($w)) == -1){
    907. 

  907. 			return str_replace(array("\x01", "\x02", "\x03", "\x04", "\x05", "\x07"), array('<', '>', "\n", "\r", "\t", ' '), $t);
    908. 

  908. 		}
    909. 

  909. 		$s = strpos(" $w", 't') ? "\t" : ' ';
    910. 

  910. 		$s = preg_match('`\d`', $w, $m) ? str_repeat($s, $m[0]) : str_repeat($s, ($s == "\t" ? 1 : 2));
    911. 

  911. 		$n = preg_match('`[ts]([1-9])`', $w, $m) ? $m[1] : 0;
    912. 

  912. 		$a = array('br'=>1);
    913. 

  913. 		$b = array('button'=>1, 'input'=>1, 'option'=>1);
    914. 

  914. 		$c = array('caption'=>1, 'dd'=>1, 'dt'=>1, 'h1'=>1, 'h2'=>1, 'h3'=>1, 'h4'=>1, 'h5'=>1, 'h6'=>1, 'isindex'=>1, 'label'=>1, 'legend'=>1, 'li'=>1, 'object'=>1, 'p'=>1, 'pre'=>1, 'td'=>1, 'textarea'=>1, 'th'=>1);
    915. 

  915. 		$d = array('address'=>1, 'blockquote'=>1, 'center'=>1, 'colgroup'=>1, 'dir'=>1, 'div'=>1, 'dl'=>1, 'fieldset'=>1, 'form'=>1, 'hr'=>1, 'iframe'=>1, 'map'=>1, 'menu'=>1, 'noscript'=>1, 'ol'=>1, 'optgroup'=>1, 'rbc'=>1, 'rtc'=>1, 'ruby'=>1, 'script'=>1, 'select'=>1, 'table'=>1, 'tfoot'=>1, 'thead'=>1, 'tr'=>1, 'ul'=>1);
    916. 

  916. 		ob_start();
    917. 

  917. 		if(isset($d[$p])){
    918. 

  918. 			echo str_repeat($s, ++$n);
    919. 

  919. 		}
    920. 

  920. 		$t = explode('<', $t);
    921. 

  921. 		echo ltrim(array_shift($t));
    922. 

  922. 		for($i=-1, $j=count($t); ++$i<$j;){
    923. 

  923. 			$r = ''; list($e, $r) = explode('>', $t[$i]);
    924. 

  924. 			$x = $e[0] == '/' ? 0 : (substr($e, -1) == '/' ? 1 : ($e[0] != '!' ? 2 : -1));
    925. 

  925. 			$y = !$x ? ltrim($e, '/') …
    926.

Large files files are truncated, but you can click here to view the full file