Forum Formatting with MySQL Database

[madmatter23]

Just looking for some ideas on forum formatting...

I'm creating a site that essentially acts as a forum in so far as a user can make posts which are then viewed by other users. I'm having a bit of trouble making the users' posts flexible in terms of formatting. The users' posts are stored in a TEXT field on a MySQL database, which run mysql_real_escape_string on all inputs before inserting data.

So far, I am able to recreate line breaks and allow for quotes and double quotes to appear normally using these functions

$post = str_replace(array("\r\n", "\n", "\r"), "<br />", $post);
$post = preg_replace('/(\\\")/',"&quot;", $idea); // replaces \" with "
$post = preg_replace("/(\\\')/","&rsquo;", $idea); // replace \' with '
$post = preg_replace('/(\\\")/',"&quot;", $title);
$title = preg_replace("/(\\\')/","&rsquo;", $title);


One of the most annoying problems is that my current system I doesn't retain indenting. IE: If you place 3 spaces before the text at the beginning of a new line, it doesn't register. I could replace all spaces with &nbsp; but that's going to make my extremely messy.

I'd like to eventually also allow the user to insert URLs into their posts, use bold and italics, and change the color of their fonts.

For links I suppose I could use a preg_replace and a regex to recognize "http://XXX/XXX.XXX," change it to [URL]XXX[URL], store the info, then recreate the link when the info is called on another page. That seems like it could get tricky... especially because it's going to involve a lot of string manipulation to remove the mysql_real_escape_string escapes from the URL.

I'm wondering if anyone knows of any more efficient ways to achieve these goals as my methods seem to be complex and messy.

Thanks a lot.

[bcarl314]

You might want to do a google search on "ubbc code php". There's a lot of example code already out there that should help you.

[madmatter23]

Perfect. Thanks so much. I didn't realize that this type of code was called UBBC, that helps a lot with the search.

I found a code that seems to be pretty good. The comments are in German but it's fairly straightforward so I don't think I'll have trouble.

One thing though, this code says that it needs to be modified because of security leaks. I'm wondering what type of security leaks I need to worry about.

As I understand it, it's just a massive preg_replace script that takes $text and replaces all of the UBBC shortcuts with HTML tags. Can anyone tell me what risks I should be concerned about?

The code is at http://scripts.php-quake.net/show.php/ubbc.php

[bcarl314]

Yep, that's exactly the ubbc script that I use. Well, at least that's where I started. I made it into a method in a class that I use, and a few other mods to reduce the XSS problems.