如何用nl2br在html标签之间添加br？

Question

我有一个 PHP 的 webmail 脚本，我今天收到了来自 gmail 的邮件，内容如下:

$content='
<p>This is just example for MessageContent</
p>Test...<span>Test</span>Test..<span
>Test</span>';

我怎样才能用 nl2br print它呢？

如果我用 echo nl2br($content);，结果是这样的：

<br />
<p>This is just example for MessageContent</<br />
p>Test...<span>Test</span>Test..<span<br />
>Test</span>

所以我该如何修正这个问题？

Answer 1

Personally I think accepting html in a message is bad, and you should strip out any html, why?

Because if you accept html tobe rendered. eg: not using htmlentities($content) from an unknown source then a malicious person could add javascript and XSS attack you, or a dodgy link and CSRF you or even just a 1px image and get your IP.

But if you accept the risk you can just render the message as-is.

<?php 
$content='
<p>This is just example for MessageContent</
p>Test...<span>Test</span>Test..<span
>Test</span>';

//Or at least sanitise abit - Remove all tags except p's an a's
$content = strip_tags($content,'<p><a>');
?>

nl2br is for content you expect to have no html in it.