The Infamous <embed> Tag

[pixelpump]

I humbily submit that as video is now such a huge part of the web experience... lacking the <embed> tag is going to suck. I know it can be enabled, but it leaves a pretty alarming security gap.

Would it be posible to have seperate HTML tags allowable for admins and gods, but not for regular users?

[savant]

i thought about what you said.
Admin and gods

what we could do here is

if(user == god){
content = strip_tags($post['content'],"<embed>...moretags");
}else{
content = strip_tags($post['content'],"tags");
}
but i haven't found where this happens. so bear with me.

if you do find it yourself, please post where.

[stephencarr]

To me that sounds like a quick fix, which is fine. But I think a better longterm solution would be for regexp to look at an <embed> tag and see if it fits with the standard google/youtube format, if it doesn't strip it, if it does carry on. Either that or have a field where a user can enter in the UID for a google or youtube vid and the software does the <embed> tag building. The latter solution is a bit crummy as you have to ask your user to find and extract the UID for the video and then paste it into the field.

[savant]

yeah its a quick fix.

I like the idea of using regexp, and we can store all these patterns somewhere as there will be a lot of sites which people will want to use.
I'm not good at using regexp (a beginner), so if you know the patter please suggest it.