Formatting and Highlighting PHP Code Listings

This is something I have been working on for a while so I am glad to find a site like yours talking about it.

Now, after downloading your example I see that the there is a problem with your code. (though it might not be to some people).

You highlighter wraps everything in code not just PHP/XHTML code.

The same way php.nethandles it in the manual.

So how would you stop the highlighter from going beyond "< ?php" or "< code >" tags?

Otherwise you might as well clean the data then just run

<?php
 
function highlight_php($code) {
    $code = '<div class="php">'. highlight_string($code, true). '</div>';
    return $code;
}
 
?>

Also, it seems that even doing this will allow attacks so why not just go with BBcode since something like http://htmlpurifier.org/ is over 350kbs? - and yet other than removing all HTML code it is the only thing that works?

Fri, 25 May 2007 at 18:39:36 GMT Link

As you'll note with your own comment, not everything is enclosed in <code> tags. Only the code is.

hmm.... well you the code in your example must be missing something. Because while the code that process your comments can tell code from text - the highlighter can't - or at least I am missing something. I have tried a couple things and I can't get it to stop highlighting after (or before) the code.

<blockquote><p>More information is available at the following URL:</p></blockquote>

I read the whole page and all the comments but I don't see anywhere where it talks about stopping the highlighter from highlighting everything..?

Regarding your last statement, BBCode does nothing to improve security, and Paul's comment is about strip_tags().

But since browsers ignore bbcode - it seems like the most secure way to process input is if you striped ALL html code from the text (thereby avoiding what preinheimer was talking about) and then used something like phpBB's bbcode processor to accomplish the same thing that the 350k htmlpurifier does.

Of course this is assuming that all of the highlighting code examples I have seen on this site are incomplete (at least for a newbe like me) and we are still looking for a 99% secure way to process code - right? or am I missing somthing?

Also, what about adding to your code using some kind of preg_replace() to clean out "style="color:#000;"", or "onClick="dothis()"", or "a href="javascript:alert('XSS')"" - would that work?

Fri, 25 May 2007 at 19:39:54 GMT Link

Assuming you have the code highlighting method defined in a class, you can use a regular expression for the replacement:

That is what I was looking for :D

You highlighter runs everything through it - but by placing it in a function I can use regex to limit it to just run through the text in-between the opening an closing code brackets.

I also found another way to do it. Split the text up into different array elements and only run the "code" elements through the highlighter.

The rest of the code gets the old "htmlspecialchars" treatment and then, like you show in your other post (url not needed at this point), you can use more regex to only allow certain codes like "em".

Great, now I have something to play with ;)

Only the "preg_replace" you showed be didn't work - but that's fine I just wanted the logic.

Thanks!

Fri, 25 May 2007 at 21:52:39 GMT Link

Hey Chris,

How have you been? ;)

What do you think of adding class="php" to your code tags?

You could do:

<code class="php>

<span class="keyword">if</span>

</code>

or:

<span class="php keyword">if</span>

The CSS would be:

.php .keyword, /* class php with descendent keyword */

.php.keyword { /* both php AND keyword in same tag */

/* your style */

}

I used the typical code and span markup (to make sure the example got through your Friggin' Sharks With Friggin' Laser Beams form processing) but the CSS doesn't care about the tags used, only the classes applied in them.

Then when you want to post examples of crappy Ruby || Perl || JavaScript you can use different styles for them.

Perhaps you already do this but not on the comments, I'm too lazy to look.

Later,

John

Sun, 17 Jun 2007 at 23:36:41 GMT Link

I want to first say thanks to a great code highlighting solution.

Also for those of us using it for php files I wanted to add a function for the processing to link function names to the manual on php.net

function function_link($test_string) {
    $linked_string = '';
    //$manual = 'http://www.php.net/function.';
    $manual = 'http://www.php.net/';
    $linked_string = preg_replace(
        // Match a highlighted keyword
        '~([\w_]+)(\s*</span>)'.
        // Followed by a bracket
        '(\s*<span\s+class="' . $this->previous . '">\s*\()~m',
        // Replace with a link to the manual
        '<a href="' . $manual . '$1" target="_blank">$1</a>$2$3', $test_string);
    return $linked_string;
  }

Didn't know if that would be of interest to anyone

Wed, 29 Aug 2007 at 11:18:43 GMT Link

how can display code without line numbers ?

Fri, 30 Nov 2007 at 11:18:26 GMT Link

Not using <ol> or CSS like

ol { list-style: none; }

Tue, 09 Jun 2009 at 10:20:44 GMT Link