确保给定的字符串包含iframe或object标记

Question

We are adding embeddable content that users can add. This opens up for a lot of exploits, and i want to start minimizing the potential damage.

First off I need to make sure the embeddable string starts with either <iframe> or <object> and ends with </iframe> or </object>

Found this: https://stackoverflow.com/questions/28118798/how-can-i-check-a-string-is-iframe-tag-by-php-functions

but I need to rewrite it, and I'm at a loss.

$string = '<iframe src="sourceurl"></iframe>';
$test = strpos($string,'<iframe');
if (!empty($test)) {
    echo 'That has an iframe!!';
} else {
    echo 'There's no iframe in there...';
}

How do I attack this? And on a sidenote, should I just scrap object embeds? They feel highly vulnerable..

Answer 1

This is happening because <iframe is at the beginning of your $string meaning that strpos will return 0 cause the <ifrma start from the position 0 and because empty(0) will return true (meaning it is empty) which is not true in our cause because 0 in our case means something.

to solve this problem just replace !empty($test) with $test >= 0 something like this :

$string = '<iframe src="sourceurl"></iframe>';
$test = strpos($string,'<iframe');

//in this case $test = 0 cause it is at the start of the string

if ($test >= 0) {
  echo 'That has an iframe!!';
} else {
  echo 'There\'s no iframe in there...';
}

// you can even use Regular Expressions 
// to ensure that your string starts with <iframe , here is an example : 

// ^ : means start with.
if(preg_match('/^<iframe /',$string)){
    echo 'That has an iframe using Regular Expressions!!';      
}

Hope it helps.