Keep user content contained

corblimey

A part of my CMS uses user-generated templates to display data. Itr's all well and good if the template is correct, with opening div's, closing div's, proper syntax all that. But if the template has say one too many </div>'s it interferes with the page I'm displaying the data on (so the template's last </div> is actually closing my main div causing display issues).

Other than a iframe or (shudder) a popup is there any way of isolating this kind of thing such that it will display on the page but not interfere with its containers?

Liam Byrne

corblimey wrote: »

A part of my CMS uses user-generated templates to display data. Itr's all well and good if the template is correct, with opening div's, closing div's, proper syntax all that. But if the template has say one too many </div>'s it interferes with the page I'm displaying the data on (so the template's last </div> is actually closing my main div causing display issues).

Other than a iframe or (shudder) a popup is there any way of isolating this kind of thing such that it will display on the page but not interfere with its containers?

That makes little sense, TBH.

If the template has one too many </div>s, then take it out.
If the content has one too many </div>s, then take that out.

If every item of content closes its own tags, then you won't encounter a problem.

corblimey

That's all well and good when it's my own code, but the template can be edited by the user, so I have very little control over it. I don't expect them to validate it and the chances of a rogue </div> or a misspelled </span> cocking up my page are higher than I'd like. If it works locally for them then it should work on the site.

Liam Byrne

Haven't tried this, but might help you

http://htmlpurifier.org/

Evil Phil

corblimey wrote: »

That's all well and good when it's my own code, but the template can be edited by the user, so I have very little control over it. I don't expect them to validate it and the chances of a rogue </div> or a misspelled </span> cocking up my page are higher than I'd like. If it works locally for them then it should work on the site.

Are they editing the template through the CMS? If so you could parse their html to find unclosed tags and insert them.

corblimey

They have the ability to edit it in-situ, but they can also slap together their own html, broke as it may be, and upload that. I'll take a look at that HTML Purifier thing, my CMS is PHP5, so it might blend in nicely.