Logo Questions Linux Laravel Mysql Ubuntu Git Menu
 

Why should I use BBCode but not HTML in comment forms?

I'm writing a comment parsing function in PHP.

Since BBCode is not a real markup language, I'v never liked the writing style.
So I'm giving visitors the ability to use basic HTML code in comment forms.
And when posting, PHP will check for disallowed and invalid tags/attributes, and either replace or remove them.

I believe it does the same job and output exactly the same as with BBCode.

If this is true, why are there BBCode? Does BBcode have any advantages over HTML?

update

as monochrome answered

If you're confident that your HTML filter is safe enough, you should be fine though

well, I'm not confident writing the filter myself, but there are some top-rated filters out there like PHP Simple HTML DOM Parser, HTML Purifier, htmLawed...

The BBCode is developed by UBB and still being widely used, such as phpBB.

Are the developers from UBB/phpBB not confident about their skills to write a perfect HTML filter? (I guess not)

Also, like the Markdown that StackOverflow's using...if HTML+Parser does the job, why invent another "language" anyway? (except for saving a few bits...)

like image 625
Jon Avatar asked Sep 01 '11 08:09

Jon


1 Answers

It's main advantage is the prevention of unwanted code injections. That's why I would use something like BBCode or Markdown.

At least you should work with a White-List of allowed HTML-Tags and not with blacklisting.

like image 109
Fabian Barney Avatar answered Sep 21 '22 02:09

Fabian Barney