I’m putting together a small site that will allow users to embed youtube and vimeo videos, similar to what Tumblr does. They allow the URL and/or the embed code to be pasted into a textarea and then submitted.
I’m curious if anybody has any thoughts on how to do this? Would it just be a series of regex filters, stripping out the code until you get to the video’s ID and then INSERTing only that, plus a flag saying which video site it belongs to?
Or would you allow the full embed code? Sure, I will use mysql_real_escape_string(), but that doesn’t strip out some smartass inserting javascript or PHP from the embed code.
Then again, if they paste the wrong code, it’s their fault the video won’t work, isn’t it?