PHP: Block all hyperlink to the guests - hyperlink

Question

I am trying to find solution since 2 hours to block hyperlink to the guests but no luck.
Text content is loading from database and rendering with HTML format. All links user add either plain http:// format or anchor tag it is automatically convert to the link.
I want to hide/block all hyperlink from guests user. I need your great help.. really stuck.
I am getting content from database with this array $data['content'] this is html content.

Answer 1

Without seeing your code or knowing more about the context, here is something to study and apply to you situation: put this code into a file called demo.php or something like that and run it on the command line:
<?php
$text_with_links[] = 'http://example.com';
$text_with_links[] = 'Link';
echo "User text:\n\n";
foreach ( $text_with_links as $text_example ) {
echo "\t${text_example}\n";
}
echo "\n\n";
echo "Use text filtered by htmlspecialchars:\n\n";
foreach ( $text_with_links as $text_example ) {
echo "\t" . htmlspecialchars( $text_example ) . "\n";
}
echo "\n\n";
echo "Use text filtered by strip_tags:\n\n";
foreach ( $text_with_links as $text_example ) {
echo "\t" . strip_tags( $text_example ) . "\n";
}
You should see something like this:
$ php demo.php
User text:
http://example.com
Link
Use text filtered by htmlspecialchars:
http://example.com
<a href="http://example.com">Link</a>
User text filtered by strip_tags:
http://example.com
Link
This demonstrates the use of two core PHP functions, htmlspecialchars and strip_tags. Read the documentation for these here:
http://www.php.net/manual/en/function.htmlspecialchars.php
http://www.php.net/manual/en/function.strip-tags.php
Notice how neither of these functions make changes to the user entry "http://example.com". When you say that "All links user add either plain http:// format ... it is automatically convert to the link.", I suspect that there is a process happening in the middle that you are leaving out. Simply printing the string "http://example.com" onto a page will not normally cause it to be rendered as an HTML anchor tag.
As others have commented, to get the best help you should follow stackoverflow.com guidelines and provide all relevant details and context to your problem, and also print the code that you have tried so far so others can correct it and also get a better idea of what you are dealing with.
Please mention what framework or CMS you are using (as I strongly suspect you are using one). Drupal, Joomla, Wordpress, etc.
For the time being, you can simply remove "http://" from all strings you retrieve from the database using str_replace() - http://www.php.net/manual/en/function.str-replace.php. That is not the best solution though. I think what is happening is that the software you are using is converting the "http:// format" text (to use your words) into HTML anchor tags for you.
For example, if you are using Drupal and have provided a webform that guests have access to, you should change the format from "Full HTML" to something more limited, otherwise you are allowing anonymous users to entered HTML into your database.
You may not need a PHP code solution at all. The best thing is to check the controls on the WYSIWYG editor that you provide your guest users and make sure the template is set up correctly.
Also, you should Google "prevent XSS attacks PHP", and "prevent SQL injection PHP". This is research that you must do if you wish to have a secure website.
Good luck. If you provide more details, I and others can give you more specific help.
EDIT: Printing what I wrote in comment below, for easier reading:
$content_tags_stripped = strip_tags( $data['content'] );
OR
$content_no_htmlspecialchars = htmlspecialchars( $data['content'] );
Then use those variables in your code instead of $data['content'].
But please study the rest of what I wrote when you have the time. I think you will be able to find a more satisfactory solution to your problem that way. Good luck.