strip javascript from input and allow only certaint htmltags

thanks, but as my initial post indicated, I allready know about strip_tags, but are after a more complex custom function.

* strip all tags unless spesified (strip tags can do this)
* strip all embed javascripts unless allowed on some attributes

code below looks promising, but as sych says in the last comment(in http://no2.php.net/strip_tags). it' better to spesify what's allowed, than what's not...

<?php
function strip_tags_attributes($sSource, $aAllowedTags = array(), $aDisabledAttributes = array('onabort', 'onblue', 'onchange', 'onclick', 'ondblclick', 'onerror', 'onfocus', 'onkeydown', 'onkeyup', 'onload', 'onmousedown', 'onmousemove', 'onmouseover', 'onmouseup', 'onreset', 'onresize', 'onselect', 'onsubmit', 'onunload'))
    {
        if (empty($aDisabledAttributes)) return strip_tags($sSource, implode('', $aAllowedTags));
 
        return preg_replace('/<(.*?)>/ie', "'<' . preg_replace(array('/javascript:[^\"\']*/i', '/(" . implode('|', $aDisabledAttributes) . ")[ \\t\\n]*=[ \\t\\n]*[\"\'][^\"\']*[\"\']/i', '/\s+/'), array('', '', ' '), stripslashes('\\1')) . '>'", strip_tags($sSource, implode('', $aAllowedTags)));
    }
?>

                                              

1:
2:
3:
4:
5:
6:
7:
8:

If you can tell us what you want to allow in Javascript, it would be easier to understand your objectives.  From a security standpoint (not to mention user-annoyance-factor) ANY unexpected Javascript, or arbitrarily denied Javascript may produce unwanted results.  Take care!

yes yes.
 look at the function I posted. it can be as simple as that exept, that instead of spesifying disabled atributes , I want to spesify allowed atributes.

I can't go trough the javascript code embed and analyze the stuff, that would be too complicated. It would be easier to just allow or dissallow the atribute the javascript can be posted in. however we also have a tag with javascript that habe to be taken care of, without disabling the href tag.

I want a general function so I can allow and dissallow atributes and tags....

Dissallowed stuff (but I also want to be able to enable this):
<a href="javascript:alert('test')">test</a>
<a href="#" onclick="alert('test');">test</a>
<div onmouseover="nastyhack1();" onclick="nastyhack2();">test</div>

okey. I have made some code that finds every tag. now how do match all these different ways to write attributes?

<a href="#" onclick="alert('test1');">test1</a>
<br><br>
<a href="#" onclick=alert('test2');>test2</a>
<br><br>
<a href="#" onclick='alert("test3");'>test3</a>
<br><br>
<a href="#" onclick = 'alert("test4");'>test4</a>
<br><br>
<a href="#" onclick = alert("test5");>test5</a>
<br><br>
<a href="#" onclick = alert("test6"); onmouseover=alert("test7");>test67</a>
<br><br>
<a href="#" onclick = alert("test8")>test8</a>

Here is the strings I have to match the attribute from:
a href="#" onclick="alert('test1');"
a href="#" onclick=alert('test2');
a href="#" onclick='alert("test3");'
a href="#" onclick = 'alert("test4");'
a href="#" onclick = alert("test5");
a href="#" onclick = alert("test6"); onmouseover=alert("test7");
a href="#" onclick = alert("test8")

best would be to strip any atributes that are malformed and then prosess the atributes that are in this format:
onclick="alert('test1')"

so I need the regexp to match:
onclick="alert('test1');"

hmm.. I'm not the biggest expert on regexp...

okey . got that sorted out...
now, I need som help on the tag match:
regexp = '/<(.*?) (.*?)>/i'
as the tags can be in htmlentity or perhaps other ways (unicode?)?

http://www.w3schools.com/tags/ref_entities.asp
&lt; <
&gt; >

I need to match theme no mather if < and > is in htmlentity or (unicode) or a normal < and >.

okey looks like I have been thinking wrong about < and >.
if it is in htmentity it will offcource not be interpreted as a tag in the browser.
$sSource = '&#60;a href="javascript:alert(\'test\')" onclick="test()"&#62;test&#60;/a&#62;';

is there any way to write < and > so that my regexp will not be matched with my regexp and be intepreted in browser?
regexp = '/<(.*?) (.*?)>/i'


and another thing, i have this regexp to match atributes in this format:
onlclick=""
regexp = '/(.*?)=\"(.*?)\"/i'

however it would be better if the regexp could match:
onlclick=""
onlclick = ""