public static String restrictHTML ( String src , boolean allowFormatting , boolean allowImages , boolean allowLinks ) { // TODO: these regexes should probably be checked to make // sure that javascript can't live inside a link ArrayList < String > allow = new ArrayList < String > ( ) ; if ( allowFormatting ) { allow . add ( "<b>" ) ; allow . add ( "</b>" ) ; allow . add ( "<i>" ) ; allow . add ( "</i>" ) ; allow . add ( "<u>" ) ; allow . add ( "</u>" ) ; allow . add ( "<font [^\"<>!-]*(\"[^\"<>!-]*\"[^\"<>!-]*)*>" ) ; allow . add ( "</font>" ) ; allow . add ( "<br>" ) ; allow . add ( "</br>" ) ; allow . add ( "<br/>" ) ; allow . add ( "<p>" ) ; allow . add ( "</p>" ) ; allow . add ( "<hr>" ) ; allow . add ( "</hr>" ) ; allow . add ( "<hr/>" ) ; } if ( allowImages ) { // Until I find a way to disallow "---", no - can be in a url allow . add ( "<img [^\"<>!-]*(\"[^\"<>!-]*\"[^\"<>!-]*)*>" ) ; allow . add ( "</img>" ) ; } if ( allowLinks ) { allow . add ( "<a href=[^\"<>!-]*(\"[^\"<>!-]*\"[^\"<>!-]*)*>" ) ; allow . add ( "</a>" ) ; } return restrictHTML ( src , allow . toArray ( new String [ allow . size ( ) ] ) ) ; }
Restrict HTML except for the specified tags .