public static function filter($string, array
$allowed_html_tags = NULL
) { if (is_null($allowed_html_tags)) { $allowed_html_tags =
static::
$htmlTags;
} // Only operate on valid UTF-8 strings. This is necessary to prevent cross
// site scripting issues on Internet Explorer 6.
if (!Unicode::
validateUtf8($string)) { return '';
} // Remove NULL characters (ignored by some browsers).
$string =
str_replace(chr(0
), '',
$string);
// Remove Netscape 4 JS entities.
$string =
preg_replace('%&\s*\{[^}]*(\}\s*;?|$)%', '',
$string);
// Defuse all HTML entities.
$string =
str_replace('&', '&',
$string);
// Change back only well-formed entities in our list of allowed html tags:
// Decimal numeric entities.