More info... this is from the GPL input filter available on the net. It uses this function to filter attributes.
Code:
function filterAttr($attrSet) {
$newSet = array();
for ($i = 0; $i <count($attrSet); $i++) {
if (!$attrSet[$i]) continue;
$attrSubSet = explode('=', trim($attrSet[$i]));
list($attrSubSet[0]) = explode(' ', $attrSubSet[0]);
if ((!eregi("^[a-z]*$",$attrSubSet[0])) || (($this->xssAuto) && ((in_array(strtolower($attrSubSet[0]), $this->attrBlacklist)) || (substr($attrSubSet[0], 0, 2) == 'on'))))
continue;
if ($attrSubSet[1]) {
$attrSubSet[1] = str_replace('&#', '', $attrSubSet[1]);
$attrSubSet[1] = preg_replace('/\s+/', '', $attrSubSet[1]);
$attrSubSet[1] = str_replace('"', '', $attrSubSet[1]);
if ((substr($attrSubSet[1], 0, 1) == "'") && (substr($attrSubSet[1], (strlen($attrSubSet[1]) - 1), 1) == "'"))
$attrSubSet[1] = substr($attrSubSet[1], 1, (strlen($attrSubSet[1]) - 2));
$attrSubSet[1] = stripslashes($attrSubSet[1]);
}
if ( ((strpos(strtolower($attrSubSet[1]), 'expression') !== false) && (strtolower($attrSubSet[0]) == 'style')) ||
(strpos(strtolower($attrSubSet[1]), 'javascript:') !== false) ||
(strpos(strtolower($attrSubSet[1]), 'behaviour:') !== false) ||
(strpos(strtolower($attrSubSet[1]), 'vbscript:') !== false) ||
(strpos(strtolower($attrSubSet[1]), 'mocha:') !== false) ||
(strpos(strtolower($attrSubSet[1]), 'livescript:') !== false)
) continue;
$attrFound = in_array(strtolower($attrSubSet[0]), $this->attrArray);
if ((!$attrFound && $this->attrMethod) || ($attrFound && !$this->attrMethod)) {
if ($attrSubSet[1]) $newSet[] = $attrSubSet[0] . '="' . $attrSubSet[1] . '"';
else if ($attrSubSet[1] == "0") $newSet[] = $attrSubSet[0] . '="0"';
else $newSet[] = $attrSubSet[0] . '="' . $attrSubSet[0] . '"';
}
}
return $newSet;
}
Bookmarks