Checking link syntax of user input

Question

I have a site where users can enter comments and descriptions. I allow them to enter links in as well. I use strip_tags with an exception for links. I also add rel="nofollow" through a simple string_replace.

The problem is, if users leave off a double quote at the end of their opening tag, it messes up the html. Any suggestions on how to check for or fix incorrect link syntax?

$comment = $_POST['comment'];
$comment = strip_tags($comment,"<a>");
$comment = str_replace('<a','<a rel="nofollow"',$comment);
$comment = mysql_real_escape_string($comment);

and when outputting

$comment = stripslashes($comment);

echo $comment;

The problem is when users add <a href="www.blah.com> and forget the last double quote, this messes up the way the comment div displays.

Answer 1

Here's what you have to do:

function fixLink($link) {
    $link = str_replace(array('<a', '"', '</a>'), '', $link);
    $link = str_replace(
        array('=', '>', ' '),
        array('="', '">', '" '),
        $link);
    return '<a rel="nofollow' . $link . '</a>';
}    

echo fixLink('<a href="/index.html>asd</a>') . "\n";
echo fixLink('<a class="awesome" href="/index.html>asd</a>') . "\n";
echo fixLink('<a href="/index.html class="awesome">asd</a>') . "\n";
echo fixLink('<a target="_blank" href="/index.html class="awesome">asd</a>') . "\n";
echo fixLink('<a target="_blank" href="/index.html class="awesome>asd</a>') . "\n";
echo fixLink('<a target="_blank" href="/index.html target="_blank" class="awesome">asd</a>') . "\n";
echo fixLink('<a href="/index.html class=awesome">asd</a>') . "\n";

That will output:

<a rel="nofollow" href="/index.html">asd</a>
<a rel="nofollow" class="awesome" href="/index.html">asd</a>
<a rel="nofollow" href="/index.html" class="awesome">asd</a>
<a rel="nofollow" target="_blank" href="/index.html" class="awesome">asd</a>
<a rel="nofollow" target="_blank" href="/index.html" class="awesome">asd</a>
<a rel="nofollow" target="_blank" href="/index.html" target="_blank" class="awesome">asd</a>
<a rel="nofollow" href="/index.html" class="awesome">asd</a>