question about html tags

Posted: Mon Jan 03, 2005 10:18 pm

i know about changing the tags allowed in the config.php file but i already tried that and i am still getting:

"The html tags you attempted to use are not allowed"

error.

I basically want to add this to one of my blocks:

<STYLE="TEXT-DECORATION: NONE">

so that i don't get the underline marks in a particular hyperlink. any advice on how to be able to allow this code? thanks. Very Happy

Site Admin/Owner Joined: Aug 27, 2002 Posts: 17088

See the second post at http://www.ravenphpscripts.com/posts3934-highlightisadmin.html+admin

Posted: Mon Jan 03, 2005 10:59 pm

okay, i tried this and when i loaded it as the new mainfile.php, my site goes to a blank page. any ideas?

Posted: Tue Jan 04, 2005 5:09 am

That normally means you forgot to add the closing }.

Posted: Tue Jan 04, 2005 9:50 am

i checked for that specifically. could it be anything else?

Posted: Tue Jan 04, 2005 9:57 am

Post that section of your mainfile.php

Posted: Tue Jan 04, 2005 12:11 pm

okay, here it is:

Quote:

if (!is_admin($admin)) {
foreach ($_GET as $secvalue) {
if ((eregi("<[^>]*script*\"?[^>]*>", $secvalue)) ||
(eregi("<[^>]*object*\"?[^>]*>", $secvalue)) ||
(eregi("<[^>]*iframe*\"?[^>]*>", $secvalue)) ||
(eregi("<[^>]*applet*\"?[^>]*>", $secvalue)) ||
(eregi("<[^>]*meta*\"?[^>]*>", $secvalue)) ||
(eregi("<[^>]*style*\"?[^>]*>", $secvalue)) ||
(eregi("<[^>]*form*\"?[^>]*>", $secvalue)) ||
(eregi("$[^>]*\"?[^)]*$", $secvalue)) ||
(eregi("\"", $secvalue))) {
die ("<center><img src=images/logo.gif> The html tags you attempted to use are not allowed [ <a href=\"javascript:history.go(-1)\">Go Back</a> ]");
}
}

foreach ($_POST as $secvalue) {
if ((eregi("<[^>]script*\"?[^>]*>", $secvalue)) || (eregi("<[^>]style*\"?[^>]*>", $secvalue))) {
die ("<center><img src=images/logo.gif> The html tags you attempted to use are not allowed [ <a href=\"javascript:history.go(-1)\">Go Back</a> ]");
}
}
}

what do you think?

Posted: Tue Jan 04, 2005 2:46 pm

There's nothing wrong with that. Are you sure that's what's causing you the error?

Posted: Tue Jan 04, 2005 4:26 pm

no, i am not sure that's what is causing the error but what else could it be? i am basically taking the above text and pasting it over my existing text in my mainfile.php file of root server, is that correct?

also, the page only comes up blank when i am logged in as admin, not when logged in as a regular user. any help you guys? thanks.

Subject Matter Expert Joined: Feb 23, 2004 Posts: 358

If it's going to be added to a block within Nuke, there's an easier way... add a new class (name and all) to your Nuke theme css file, and call the class inside the block where you need it... no altering of the mainfile needed! As well, there might already be a class in the css file that will do exactly as you need... those are there for each theme for a reason, so that the site looks uniform everywhere!

The problem with hacking the mainfile is that when you upgrade Nuke every other day, you always have to remember to re-add the little hacks... much better to alter the theme/css, as those files rarely change due to security enhancements.

PHrEEk

Posted: Tue Jan 04, 2005 5:37 pm

thanks for reply but i am lost as to what you are referring to. what is a "Class" and what .css file am i looking for..style.css in my theme directory?

thanks for offering to help!!! Very Happy

Posted: Tue Jan 04, 2005 5:47 pm

Candy,

PM me your cPanel id/pass and I'll take a look at your files.

Posted: Tue Jan 04, 2005 6:39 pm

Up front:
Good CSS Tutorial/starter site
http://www.tizag.com/cssT/

What you are proposing on your original post is referred to as an 'inline' CSS tag. Inline elements override what is declared in your .css stylesheet, and are typically called with the STYLE tag. One or several STYLEs can be declared in a stylesheet, given a name, and then they are referred to as a CLASS.

Yes, you are correct that you would want to alter the .css file in your Theme folder. It varies from theme to theme, but generally the .css file is in the folder /themes/{your_theme}/style/style.css

For a new class that would only affect a block, this is the only file necessary to alter. If it also needed to be used in the Forums, the Forums have their own .css file, typically located in /themes/{your_theme}/forums/forums.css

Let's look at at typical class declaration for a hyperlink (style.css file)

Code:

a:link,a:active,a:visited{color:#DCDCDC;text-decoration:none; FONT-SIZE: 10px}


a:hover{color: #EEEEEE;text-decoration:underline; FONT-SIZE: 10px}

Now everytime you add HTML for <a href= etc., it will automatically assume this class. This is also known as a 'default' class, and the class name does not have to be included (essentially, there is no class name for this type). If we add a pseudo-class however, we can call it. Let's add the pseudo-class element:

Code:

a:link,a:active,a:visited{color:#DCDCDC;text-decoration:none; FONT-SIZE: 10px}


a:hover{color: #EEEEEE;text-decoration:underline; FONT-SIZE: 10px}


a.noline:link,a.noline:active,a.noline:visted {color:#DCDCDC;text-decoration:none; FONT-SIZE: 10px}


a.noline:hover{color: #EEEEEE;text-decoration:none; FONT-SIZE: 10px}

Whenever we want a hyperlink without the underline, now we just call the pseudo-class:
<a class="noline" href= etc...

As you can see, we mirrored the defaults to a class, but changed the hover setting from underline to none for the class "noline". You can create as many different pseudo-classes as you need for default things like that. Notice in your style.css (if it's a typical theme) that there are several pseudo-classes defined for INPUT:

Code:

input{border-color: #000000;color:#000000;text-indent:2px;font:normal 10px Verdana,Arial,Helvetica,sans-serif}


input.button{background-color: #6E6E6E;font:10px Verdana,Arial,Helvetica,sans-serif}


input.mainoption{background-color: #6E6E6E;font-weight:bold}


input.liteoption{background-color: #6E6E6E;font-weight:normal}


etc...

Whenever you create a webform and use the INPUT tag, you can use it by itself to get a default value, or add the class name to have it do something different. Many block and module designers do not take the time to learn these things, and if they did, it would make their stuff more portable between themes, and overall better integrated into the overall look of the site.

PHrEEk

Posted: Tue Jan 04, 2005 9:16 pm

Candy,

Try it now, both as an admin and as a user.

Posted: Tue Jan 04, 2005 10:27 pm

raven...thanks...my site is no longer giving me a blank page, but when i try to put the following code into a new block, i still get an html tags error like before.

Quote:

my main objective is to have this specific block NOT contain underlined hyperlinks.

am i doing this wrong??!! Embarassed

thanks.

Posted: Tue Jan 04, 2005 10:44 pm

You haven't formed it correctly Smile

. Try

Code:

<a href="account-new_user.html" style="text-decoration:none;color:crimson;font-weight:bold;">Become a member today to access all of the site features!</a>

Posted: Tue Jan 04, 2005 11:13 pm

still getting the error. this is an exact cut and paste of what i have:

<a href="account-new_user.html" style="text-decoration:none;color:crimson;font-weight:bold;">Become a member today to access all of the site features!</a>

it's still giving me an error:

The html tags you attempted to use are not allowed

[ Go Back ]

registered · Useless Joined: Aug 23, 2002 Posts: 213 Location: Chicago

I think people are having problem because !is_admin is being called BEFORE !is_admin function.
I would do this:

Open mainfile.php and delete this part:

Code:

foreach ($_GET as $secvalue) {


    if ((eregi("<[^>]*script*\"?[^>]*>", $secvalue)) ||


   (eregi("<[^>]*object*\"?[^>]*>", $secvalue)) ||


   (eregi("<[^>]*iframe*\"?[^>]*>", $secvalue)) ||


   (eregi("<[^>]*applet*\"?[^>]*>", $secvalue)) ||


   (eregi("<[^>]*meta*\"?[^>]*>", $secvalue)) ||


   (eregi("<[^>]*style*\"?[^>]*>", $secvalue)) ||


   (eregi("<[^>]*form*\"?[^>]*>", $secvalue)) ||


   (eregi("<[^>]*img*\"?[^>]*>", $secvalue)) ||


   (eregi("<[^>]*onmouseover*\"?[^>]*>", $secvalue)) ||


   (eregi("\([^>]*\"?[^)]*\)", $secvalue)) ||


   (eregi("\"", $secvalue)) || 


   (eregi("forum_admin", $var_name)) || 


   (eregi("inside_mod", $var_name))) {


   die ("<center><img src=images/logo.gif><br><br><b>The html tags you attempted to use are not allowed</b><br><br>[ <a href=\"javascript:history.go(-1)\"><b>Go Back</b></a> ]");


    }


}





foreach ($_POST as $secvalue) {


    if ((eregi("<[^>]*onmouseover*\"?[^>]*>", $secvalue)) ||   (eregi("<[^>]*script*\"?[^>]*>", $secvalue)) ||   (eregi("<[^>]*style*\"?[^>]*>", $secvalue))) {


        die ("<center><img src=images/logo.gif><br><br><b>The html tags you attempted to use are not allowed</b><br><br>[ <a href=\"javascript:history.go(-1)\"><b>Go Back</b></a> ]");


    }


}

Then look for !is_admin function which looks something like this:

Code:

function is_admin($admin) {


    global $prefix, $db;


    if(!is_array($admin)) {


   $admin = base64_decode($admin);


   $admin = addslashes($admin);


   $admin = explode(":", $admin);


        $aid = "$admin[0]";


   $pwd = "$admin[1]";


    } else {


        $aid = "$admin[0]";


   $pwd = "$admin[1]";


    }


    if ($aid != "" AND $pwd != "") {


        $aid = substr("$aid", 0,25);


        $result = $db->sql_query("SELECT pwd FROM ".$prefix."_authors WHERE aid='$aid'");


   $row = $db->sql_fetchrow($result);


   $pass = $row['pwd'];


   if($pass == $pwd && $pass != "") {


       return 1;


   }


    }


    return 0;


}

And right under it, we will paste the code Raven has given us:

Code:

if (!is_admin($admin)) {


foreach ($_GET as $secvalue) {


if ((eregi("<[^>]*script*\"?[^>]*>", $secvalue)) ||


(eregi("<[^>]*object*\"?[^>]*>", $secvalue)) ||


(eregi("<[^>]*iframe*\"?[^>]*>", $secvalue)) ||


(eregi("<[^>]*applet*\"?[^>]*>", $secvalue)) ||


(eregi("<[^>]*meta*\"?[^>]*>", $secvalue)) ||


(eregi("<[^>]*style*\"?[^>]*>", $secvalue)) ||


(eregi("<[^>]*form*\"?[^>]*>", $secvalue)) ||


(eregi("\([^>]*\"?[^)]*\)", $secvalue)) ||


(eregi("\"", $secvalue))) {


die ("<center><img src=images/logo.gif><br><br><b>The html tags you attempted to use are not allowed</b><br><br>[ <a href=\"javascript:history.go(-1)\"><b>Go Back</b></a> ]");


}


}





foreach ($_POST as $secvalue) {


if ((eregi("<[^>]script*\"?[^>]*>", $secvalue)) || (eregi("<[^>]style*\"?[^>]*>", $secvalue))) {


die ("<center><img src=images/logo.gif><br><br><b>The html tags you attempted to use are not allowed</b><br><br>[ <a href=\"javascript:history.go(-1)\"><b>Go Back</b></a> ]");


}


}


}

I might be wrong but doesn't hurt to give it a shot right?

Posted: Wed Jan 05, 2005 4:51 am

PHP is a 2 pass operation. All functions are compiled in the first pass so that allows you to call a function before it is declared. Candy, is this a block file or an html block? If it's an html block, just make it a file instead.

Posted: Wed Jan 05, 2005 11:20 am

not sure how to respond. basically, i am in my admin panel trying to create a new block with the following code:

<a href="account-new_user.html" style="text-decoration:none;color:crimson;font-weight:bold;">Become a member today to access all of the site features!</a>

should i put this into an html file then put the link to the html file into the block instead?

Posted: Wed Jan 05, 2005 11:25 am

No. Make a standard block and put it in your blocks folder. Then activate it through tha ACP.

Posted: Wed Jan 05, 2005 12:03 pm

okay. another question....how can i set it so my site will take javascript? should i just create a block, load the jscript code then activate through ACP too?

Posted: Wed Jan 05, 2005 1:55 pm

http://www.ravenphpscripts.com/postt28.html