我正在使用 HTMLPurifier 来转义我网站中的字符。有效地把所有的<东西都>变成它应该的样子。我还想在站点内显示代码，但是当使用 将代码放置到站点上时，而不是将和符号呈现为并且它们保持显示为编码的.><<pre><code>...</code></pre>><<>>
我知道该 <pre> 标签旨在显示预先格式化的文本
仅当包装在标签中以使用 JS/JQuery呈现为 ( & ) 时，我将如何安全地转换这些符号 ( >& )？<<pre><code>...</code></pre><>
<php 'default' => 'local'转换成<php 'default' => 'local'
注意：渲染 HTML 标签时不会发生这种情况。我相信这是由 HTMLPurifier 引起的。
HTML 正确呈现为
<div>
...Some code here...
</div>
更新＃1：
我在网站上使用 Markdown，我的 HTMLPurifier 配置如下：
<?php
/**
* Ok, glad you are here
* first we get a config instance, and set the settings
* $config = HTMLPurifier_Config::createDefault();
* $config->set('Core.Encoding', $this->config->get('purifier.encoding'));
* $config->set('Cache.SerializerPath', $this->config->get('purifier.cachePath'));
* if ( ! $this->config->get('purifier.finalize')) {
* $config->autoFinalize = false;
* }
* $config->loadArray($this->getConfig());
*
* You must NOT delete the default settings
* anything in settings should be compacted with params that needed to instance HTMLPurifier_Config.
*
* @link http://htmlpurifier.org/live/configdoc/plain.html
*/
return [
'encoding' => 'UTF-8',
'finalize' => true,
'cachePath' => storage_path('app/purifier'),
'cacheFileMode' => 0755,
'settings' => [
'default' => [
'HTML.Doctype' => 'HTML 4.01 Transitional',
'HTML.Allowed' => 'blockquote,h1,h2,h3,h4,h5,h6,pre,code,div[class],b,strong,i,em,a[href|title],ul,ol,li,p[style],br,span[style],img[width|height|alt|src]',
'CSS.AllowedProperties' => 'font,font-size,font-weight,font-style,font-family,text-decoration,padding-left,color,background-color,text-align',
'AutoFormat.AutoParagraph' => false,
'AutoFormat.RemoveEmpty' => true,
],
'test' => [
'Attr.EnableID' => true
],
"youtube" => [
"HTML.SafeIframe" => 'true',
"URI.SafeIframeRegexp" => "%^(http://|https://|//)(www.youtube.com/embed/|player.vimeo.com/video/)%",
],
],
];
This is the method I'm using to call the Purifier
public function store(Request $request)
{
//Validate the data
$this->validate($request, array(
'title' => 'required|max:255',
'slug' => 'required|alpha_dash|min:5|max:255|unique:posts,slug',
'category_id' =>'required|integer',
'body' => 'required'
));
//Store in the database
$post = new Post;
$post->title = $request->title;
$post->slug = $request->slug;
$post->category_id = $request->category_id;
$post->body = Purifier::clean($request->body, "youtube");
$post->save();
$post->tags()->sync($request->tags, false);
Session::flash('success', 'AWESOMESAUCE! Your post was saved successfully!');
//redirect to another page
return redirect()->route('posts.show', $post->id);
}
更新 #2 (02/19/19)
这个问题导致我搜索以前的代码。问题来自 Markdown 解析器，它是Parsedown而不是 Purifier。净化器工作正常。我在下面添加了 Markdown 配置和使用代码：
<?php
/*
* This file is part of Laravel Markdown.
*
* (c) Graham Campbell <graham@alt-three.com>
*
* For the full copyright and license information, please view the LICENSE
* file that was distributed with this source code.
*/
return [
/*
|--------------------------------------------------------------------------
| Enable View Integration
|--------------------------------------------------------------------------
|
| This option specifies if the view integration is enabled so you can write
| markdown views and have them rendered as html. The following extensions
| are currently supported: ".md", ".md.php", and ".md.blade.php". You may
| disable this integration if it is conflicting with another package.
|
| Default: true
|
*/
'views' => true,
/*
|--------------------------------------------------------------------------
| CommonMark Extenstions
|--------------------------------------------------------------------------
|
| This option specifies what extensions will be automatically enabled.
| Simply provide your extension class names here.
|
| Default: []
|
*/
'extensions' => [],
/*
|--------------------------------------------------------------------------
| Renderer Configuration
|--------------------------------------------------------------------------
|
| This option specifies an array of options for rendering HTML.
|
| Default: [
| 'block_separator' => "\n",
| 'inner_separator' => "\n",
| 'soft_break' => "\n",
| ]
|
*/
'renderer' => [
'block_separator' => "\n",
'inner_separator' => "\n",
'soft_break' => "\n",
],
/*
|--------------------------------------------------------------------------
| Enable Em Tag Parsing
|--------------------------------------------------------------------------
|
| This option specifies if `<em>` parsing is enabled.
|
| Default: true
|
*/
'enable_em' => true,
/*
|--------------------------------------------------------------------------
| Enable Strong Tag Parsing
|--------------------------------------------------------------------------
|
| This option specifies if `<strong>` parsing is enabled.
|
| Default: true
|
*/
'enable_strong' => true,
/*
|--------------------------------------------------------------------------
| Enable Asterisk Parsing
|--------------------------------------------------------------------------
|
| This option specifies if `*` should be parsed for emphasis.
|
| Default: true
|
*/
'use_asterisk' => true,
/*
|--------------------------------------------------------------------------
| Enable Underscore Parsing
|--------------------------------------------------------------------------
|
| This option specifies if `_` should be parsed for emphasis.
|
| Default: true
|
*/
'use_underscore' => true,
/*
|--------------------------------------------------------------------------
| Safe Mode
|--------------------------------------------------------------------------
|
| This option specifies if raw HTML is rendered in the document. Setting
| this to true will not render HTML, and false will.
|
| Default: false
|
*/
'safe' => true,
];
用法：
<img class="img-responsive" src="{{ asset('assets/img/' . $post->image) }}" alt="{{ $post->alt }}" />
{!! Markdown::parse($post->body) !!}
<hr />