1

hopefully this is a simple question. I have a simple custom forum on my site written in PHP. For security reasons I don't allow any HTML in the forum posts. I only allow certain BBCode tags. I would however like to allow embedded YouTube videos.

So my question is this: What's the best (most secure) way to validate the YouTube embed code? YouTube is currently using iframes to embed videos, but obviously I can't just allow the iframe tag. I also need to ensure the src of the iframe is a YouTube URL, and ensure there's no other malicious bits of code in the iframe code.

2 Answers 2

2

You should allow users to use something like this:

[youtube]http://www.youtube.com/watch?v=te-TiL9YVaE[/youtube]

And then turn it to embed code using PHP when displaying a message:

function bb_youtube($post) {
    return preg_replace(
                            "#\[youtube].*?v=([^&]+).*?\[/youtube\]#im",
                            '<object width="480" height="385"><param name="movie" value="http://www.youtube.com/v/$1?fs=1"></param><param name="allowFullScreen" value="true"></param><param name="allowscriptaccess" value="always"></param><embed src="http://www.youtube.com/v/$1?fs=1" type="application/x-shockwave-flash" allowscriptaccess="always" allowfullscreen="true" width="480" height="385"></embed></object>',
                            $post
                           );
}
2

The safest way is to create a [youtube] tag. http://www.youtube.com/watch?v=PVHzXnS5Gms could become [youtube v='PVHzXnS5Gms'][/youtube] (or your syntax of choice).

To convert this into a YouTube embed code, take <object width="640" height="385"><param name="movie" value="http://www.youtube.com/v/VIDEO_ID?fs=1&amp;hl=en_US"></param><param name="allowFullScreen" value="true"></param><param name="allowscriptaccess" value="always"></param><embed src="http://www.youtube.com/v/VIDEO_ID?fs=1&amp;hl=en_US" type="application/x-shockwave-flash" allowscriptaccess="always" allowfullscreen="true" width="640" height="385"></embed></object> and replace VIDEO_ID with the identifier.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.