I have a php exploit chat problem with removing codes...?

Question

i made a code that writes to a text file and adds a usernames, then it says what they typed... then it adds <br> but it cancels out all other types of code like <font> or <b> or <i> but i recently discovered you can type <br> and it will give a line break.. someone has been using this to exploit my site... what can i do?

Answer 1

well as you say that you know it dont take html code which is text level and block level...but only one block level that is &lt;br&gt;

so dude you must be having the code with ya y dont you find it your self..

Answer 2

If the code works in the order you described, by adding the &lt;br&gt; and then filtering all tags except &lt;br&gt;, then you might be able to eliminate the problem by reversing the order and eliminating the exception for the &lt;br&gt; tag. Filter all tags, including &lt;br&gt;, and then add your &lt;br&gt;.