tl;dr
You need to parse the input HTML. Use the DOMDocument
class to represent your document, parse the input, find all <pre>
tags (using findElementsByTagName
) and escape their content.
Code
Unfortunately, the DOM model is very low-level and forces you to iterate the child nodes of the <pre>
tag yourself, to escape them. This looks as follows:
function escapeRecursively($node) {
if ($node instanceof DOMText)
return $node->textContent;
$children = $node->childNodes;
$content = "<$node->nodeName>";
for ($i = 0; $i < $children->length; $i += 1) {
$child = $children->item($i);
$content .= escapeRecursively($child);
}
return "$content</$node->nodeName>";
}
Now this function can be used to escape every <pre>
node in the document:
function escapePreformattedCode($html) {
$doc = new DOMDocument();
$doc->loadHTML($html);
$pres = $doc->getElementsByTagName('pre');
for ($i = 0; $i < $pres->length; $i += 1) {
$node = $pres->item($i);
$children = $node->childNodes;
$content = '';
for ($j = 0; $j < $children->length; $j += 1) {
$child = $children->item($j);
$content .= escapeRecursively($child);
}
$node->nodeValue = htmlspecialchars($content);
}
return $doc->saveHTML();
}
Test
$string = '<h1>Test</h1> <pre>Some <em>interesting</em> text</pre>';
echo escapePreformattedCode($string);
Yields:
<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN" "http://www.w3.org/TR/REC-html40/loose.dtd">
<html><body><h1>Test</h1> <pre>Some <em>interesting</em> text</pre></body></html>
Note that a DOM always represents a complete document. Hence when the DOM parser gets a document fragment it fills in the missing information. This makes the output potentially different from the input.
htmlspecialchars
on the tag's contents before youecho
them. That's what you should be doing on everything before you echo it as well.htmlspecialchars
quite simply