https://www.icyphoenix.com/viewtopic.php?f=35&t=8797&p=57588#p57588
-----------------------------------
Mighty Gorgon
Sat 24 Nov, 2012 11:16

Re: BBCODE - Improved Youtube Insertion
-----------------------------------
Thank you for the suggestion, I have implemented it on my dev environment and I'll probably implement officially.

I just wanted to point out that your code has a security flaw for at least two reasons:

[list=1][*][b]parse_str[/b] function has been used without specifying an output var: http://it.php.net/manual/en/function.parse-str.php
This means that someone can arbitrarily pass some OFFENDING code directly through HTTP QUERY STRING by overriding some other vars in bbcode.php (a fix is provided in my code below).
[*]Video content string is not sanitized, this means that someone can arbitrarily close the IFRAME tag by sending proper HTTP QUERY STRING and open another IFRAME with its own code (a fix is provided in my code below).[/list]



[codeblock]					//check URL type
					$video_file = $content;
					if (strpos($content, 'youtu.be') !== false)
					{
						// Short URL
						// parse the URL to split it in parts
						$parsed_url = parse_url($content);
						// get the path and delete the initial / simbol
						$video_file = str_replace('/', '', $parsed_url['path']);
					}
					elseif (strrpos($content, 'youtube') !== false)
					{
						// Long URL
						// parse the URL to split it in parts
						$parsed_url = parse_url($content);
						// get the query part (vars) and parse them into name and value
						parse_str($parsed_url['query'], $qvars);
						// send the value to the destination var.
						$video_file = $qvars['v'];
					}
					$video_file = preg_replace('/[^A-Za-z0-9]+/', '', $video_file);[/codeblock]


