The 2026 Drupal Business Survey is open. Your response will help shape the future of the Drupal business ecosystem.
By chrisschaub on
I've been looking everwhere for a clarification on Drupal 5.x input filtering. It seems that the default HTML Filter input filter now escapes all PHP tags and shows the php to the user as text if a PHP filter is not enabled? In 4.7.x the php "code as text" is not shown to the user, just nothing since it's not evaluated, it's stripped out for display. Is there built-in code filtering for Drupal 5.x? Not using any extra code filtering module.
This is a stock, out of the box install of Drupal 5.2 on linux, php 4.4.4.
Thanks.
Comments
(no title)
It is just like in 4.7.
There is the /admin/settings/filters page where you can see the "input formats": Filtered HTML, Full HTML, PHP code. You set up a default input format, and role permissions for all of them. Each input format contains a series of input filters, which act one after the other.
For enabling
<code>...</code>and<?php ... ?>content you will need the codefilter module:http://drupal.org/project/codefilter
which will let you enable the code filter in any of your input formats.
not quite from my testing
I have a vanilla install of 5.2 and 4.7.7 -- when you post a comment with the default HTML Filter, standard options, the 5.2 site shows the php escaped on preview and after post. The 4.7.7 does not, the php is removed. The php doesn't run in either case it seems.
These versions are both running on unix boxes and have verified this on ubuntu and redhat at two different hosting locations (ok, one was my house!).
Just make a comment with a full php echo statement on both versions, you'll see what I mean. 4.7.7 will not show the php code, 5.2 will. At least from my test runnning php 4.4.4.
(no title)
You are right, I just checked and the behavior has changed somehow.
In 4.7 using Filtered HTML input format, with HTML Filter enabled:
It strips out php tags and everything they contain.
In 5, using Filtered HTML input format, with HTML Filter enabled (without the codefilter module)
It escapes php tags and everything is displayed as plain text.
In 5, using Filtered HTML input format, with HTML Filter disabled (or just Full HTML input format)
It strips out everything in php tags just like 4.7
This stripping becomes somehow erratic when the php code is not in a single line and the line break filter is enabled.
It looks like the HTML Filter now, except stripping the disallowed HTML tags. also escapes the php tags, and that some other core mechanism clears any output which has been left unsafe.
great, thanks for testing
Great, thanks for testing! I thought I was going crazy. I might mark this as a bug if nobody steps up and confirms it's intended.
moving to bug
Moving this to a bug report ... http://drupal.org/node/171173 . Please reply there. Thank you.