在线编辑器主要有3大类:1.直接用textarea 标签
优点:速度快,提交方便,可以用UBB标签来弥补不能所见所得
缺点:不直观,功能非常少
2.用 DIV或者TABLE的CONTENTEDITABLE 标签,属性来让一个区域可以编辑
优点:可以很直观,可以做各种效果
缺点:此标签在mozilla下不可用,只适合IE浏览器,且对js要求高
3.用iframe或者frame的中的document的document.designMode ="On" 来实现可编辑
优点:具有上面第二条的全部优点,并且还多浏览器比如FF等支持
缺点:对js要求高.

以前一直不知道好多网站上所说的在线编辑器是怎么回事,后来在文档里发现document 对象的一个方法。

document.execCommand(command, false, value);
才知道具体原理。

一、首先来看一个例子:

<DIV contenteditable="true" style="border:dashed blue 2px">Hello World!</DIV>

保存为html网页,打开看看,在DIV里出现了一个光标,这个DIV就变成可以编辑的了。

类似的,SPAN,FONT等都可以有 contenteditable="true" 这个属性。

再试试下面的:

<DIV contenteditable="true" style="border:dashed blue 2px">Hello World!
    <IMG src="http://p.blog.csdn.net/images/p_blog_csdn_net/comstep/70786/o_logo.jpg" />
</DIV>

我们就可以拉伸图片了。

二、具体实现:

    1、需要两个页面,blank.html editor.html

    2、blank.html 作为 editor.html的一个内嵌Frame,作为编辑框。

<html>
<body topmargin="10" leftmargin="10" bgColor="#f6f6f6">
<div id="RTC" contenteditable = true></div>
</body>
</html>

    3、editor.html 主要是一些Javascript,用来处理不同的命令。

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML>
<HEAD>
<TITLE> New Document </TITLE>
<META NAME="Generator" CONTENT="EditPlus">
<META NAME="Author" CONTENT="">
<META NAME="Keywords" CONTENT="">
<META NAME="Description" CONTENT="">
<SCRIPT LANGUAGE="JavaScript">
<!--
var contentHTML;
function exeCommand(command, value)
{
document.execCommand(command, false, value);
}

// 加粗
function Black()
{
var obj = frames['ifRTC'].RTC;
obj.focus();
exeCommand('Bold', '');
}

// 斜体
function Italic()
{
var obj = frames['ifRTC'].RTC;
obj.focus();
exeCommand('Italic', '');
}

// 下划线
function UnderLine()
{
var obj = frames['ifRTC'].RTC;
obj.focus();
exeCommand('Underline', '');
}

// 向里缩进
function Indent()
{
var obj = frames['ifRTC'].RTC;
obj.focus();
exeCommand('Indent', '');
}

// 向外缩进
function Outdent()
{
var obj = frames['ifRTC'].RTC;
obj.focus();
exeCommand('Outdent', '');
}

// 无序列表
function UnorderList()
{
var obj = frames['ifRTC'].RTC;
obj.focus();
exeCommand('InsertUnorderedList', '');
}

// 有序列表
function OrderList()
{
var obj = frames['ifRTC'].RTC;
obj.focus();
exeCommand('InsertOrderedList', '');
}

// 插入图片
function Image()
{
var obj = frames['ifRTC'].RTC;
obj.focus();
ImagePath = window.prompt('请输入图片路径:', '');
exeCommand('InsertImage', ImagePath);
}

// 预览效果
function Preview()
{
var htmlContent = frames['ifRTC'].RTC.innerHTML;
var open = window.open('');
open.document.write(htmlContent);
}

// 查看编辑框里的HTML源代码
function Source()
{
var htmlContent = frames['ifRTC'].RTC.innerHTML;
if (document.all.iframeDiv.style.display == 'block')
{
    document.all.iframeDiv.style.display = 'none';
    document.all.htmlText.value = htmlContent;
    document.all.textDiv.style.display = 'block';
    document.all.htmlText.focus();
    document.all.Source.value='HTML';
}
else
{
    document.all.iframeDiv.style.display = 'block';
    document.all.textDiv.style.display = 'none';
    frames['ifRTC'].RTC.innerHTML = document.all.htmlText.value;
    frames['ifRTC'].RTC.focus();
    document.all.Source.value=' 源代码 ';
}
}

// 增加编辑框的高度
function Add()
{
document.all.ifRTC.height = document.all.ifRTC.height*1 + 50;
}
//-->
</SCRIPT>
</HEAD>

<BODY>
<TABLE width="400"border="0">
<TR>
<TD><input type="button" value="B" name="Black" onclick="Black()" /></TD>
<TD><input type="button" value="I" name="Italic" onclick="Italic()" /></TD>
<TD><input type="button" value="U" name="UnderLine" onclick="UnderLine()" /></TD>
<TD><input type="button" value="UL" name="UnorderList" onclick="UnorderList()" /></TD>
<TD><input type="button" value="OL" name="OrderList" onclick="OrderList()" /></TD>
<TD><input type="button" value="左" name="Outdent" onclick="Outdent()" /></TD>
<TD><input type="button" value="右" name="Indent" onclick="Indent()" /></TD>
<TD><input type="button" value="图" name="Image" onclick="Image()" /></TD>
</TR>
</TABLE>
<div id="iframeDiv" style="display:block">
<iframe id="ifRTC" width="400" height="200" border="1" src="blank.html" ></iframe>
</div>
<div id="textDiv" style="display:none">
<textarea id="htmlText" cols="50" rows="10"></textarea>
</div>
<br>
<input type="button" value=" + " name="Add" onclick="Add()" />&nbsp;&nbsp;
<input type="button" value=" 预 览 " name="Preview" onclick="Preview()" />&nbsp;&nbsp;
<input type="button" value=" 源代码 " name="Source" onclick="Source()" />
</BODY>
</HTML>

三、后记:

这里写的只是一个简单的编辑器,其实重要的就是:

contenteditable="true"

document.execCommand(command, false, value);
关于 document 的一些方法,可以查看MS的文档。
execCommand 的一些命令也可以在文档里找到,下面列出一些:

execCommand(command, false, value); 中的 command 可以是以下这些:

BackColor Sets or retrieves the background color of the current selection.
Bold Toggles the current selection between bold and nonbold.
ClearAutocompleteForForms Clears saved forms data.
Copy Copies the current selection to the clipboard.
CreateBookmark Retrieves the name of a bookmark anchor or creates a bookmark anchor for the current selection or insertion point.
CreateLink Retrieves the URL of a hyperlink or creates a hyperlink on the current selection.
Cut Copies the current selection to the clipboard and then deletes it.
Delete Deletes the current selection.
FontName Sets or retrieves the font for the current selection.
FontSize Sets or retrieves the font size for the current selection.
ForeColor Sets or retrieves the foreground (text) color of the current selection.
FormatBlock Sets or retrieves the current block format tag.
Indent Increases the indent of the selected text by one indentation increment.
InsertButton Overwrites a button control on the current selection.
InsertFieldset Overwrites a box on the current selection.
InsertHorizontalRule Overwrites a horizontal line on the current selection.
InsertIFrame Overwrites an inline frame on the current selection.
InsertImage Overwrites an image on the current selection.
InsertInputButton Overwrites a button control on the current selection.
InsertInputCheckbox Overwrites a check box control on the current selection.
InsertInputFileUpload Overwrites a file upload control on the current selection.
InsertInputHidden Inserts a hidden control on the current selection.
InsertInputImage Overwrites an image control on the current selection.
InsertInputPassword Overwrites a password control on the current selection.
InsertInputRadio Overwrites a radio control on the current selection.
InsertInputReset Overwrites a reset control on the current selection.
InsertInputSubmit Overwrites a submit control on the current selection.
InsertInputText Overwrites a text control on the current selection.
InsertMarquee Overwrites an empty marquee on the current selection.
InsertOrderedList Toggles the current selection between an ordered list and a normal format block.
InsertParagraph Overwrites a line break on the current selection.
InsertSelectDropdown Overwrites a drop-down selection control on the current selection.
InsertSelectListbox Overwrites a list box selection control on the current selection.
InsertTextArea Overwrites a multiline text input control on the current selection.
InsertUnorderedList Toggles the current selection between an ordered list and a normal format block.
Italic Toggles the current selection between italic and nonitalic.
JustifyCenter Centers the format block in which the current selection is located.
JustifyLeft Left-justifies the format block in which the current selection is located.
JustifyRight Right-justifies the format block in which the current selection is located.
Outdent Decreases by one increment the indentation of the format block in which the current selection is located.
OverWrite Toggles the text-entry mode between insert and overwrite.
Paste Overwrites the contents of the clipboard on the current selection.
Refresh Refreshes the current document.
RemoveFormat Removes the formatting tags from the current selection.
SelectAll Selects the entire document.
SaveAs Saves the current Web page to a file.
UnBookmark Removes any bookmark from the current selection.
Underline Toggles the current selection between underlined and not underlined.
Unlink Removes any hyperlink from the current selection.
Unselect Clears the current selection.











过滤html在线编辑器产生有危害代码
2008-04-03 14:03

部分强大的在线编辑器,已经包含了代码整理,过滤功能,但js处理的能被很轻易的饶过,服务端必须要再次过滤一次,这几天花了点时间,写了部分,希望对大家有点用处,本人能力有限,还请有能力的朋友补全它。

/*不需要过滤的数组*/
$htm_on=array(
"<acronym","acronym>",
"<baseFont","baseFont>",
"<button","button>",
"<caption","caption>",
"<clientInformation","clientInformation>",
"<font","font>",
"<implementation","implementation>",
"<button","button>",
"<location","location>",
"<option","option>",
"<selection","selection>",
"<strong","strong>",
"font");

$htm_on_uper=array(
"<ACRONYM","ACRONYM>",
"<BASEFONT","BASEFONT>",
"<BUTTON","BUTTON>",
"<CAPTION","CAPTION>",
"<CLIENTINFORMATION","CLIENTINFORMATION>",
"<FONT","FONT>",
"<IMPLEMENTATION","IMPLEMENTATION>",
"<BUTTON","BUTTON>",
"<LOCATION","LOCATION>",
"<OPTION","OPTION>",
"<SELECTION","SELECTION>",
"<STRONG","STRONG>",
"FONT");

/*字符格式*/
$str=strtolower($str);
$str=preg_replace("/\s+/", " ", $str);//过滤回车
$str=preg_replace("/ +/", " ", $str);//过滤多个空格

/*过滤/替换几种形式的js*/
$str=preg_replace("/<(script.*?)>(.*?)<(\/script.*?)>/si","",$str);//删除<script>。。。</script>格式,
//$str=preg_replace("/<(script.*?)>(.*?)<(\/script.*?)>/si","&lt;\\1&gt;\\2&lt;\\3&gt;",$str);//替换为可以显示的,

$str=preg_replace("/<(script.*?)>/si","",$str);//删除<script>未封闭
//$str=preg_replace("/<(script.*?)>/si","&lt;\\1&gt;",$str);//替换未封闭

/*删除/替换表单*/
$str=preg_replace("/<(\/?form.*?)>/si","",$str);//删除表单
//$str=preg_replace("/<(\/?form.*?)>/si","&lt;\\1&gt;",$str);//替换表单

$str=preg_replace("/<(i?frame.*?)>(.*?)<(\/i?frame.*?)>/si","",$str);//删除框架
//$str=preg_replace("/<(i?frame.*?)>(.*?)<(\/i?frame.*?)>/si","&lt;\\1&gt;\\2&lt;\\3&gt;",$str);//替换框架

/*过滤on事件*/
$str=preg_replace("/href=(.+?)([\"|\'| |>])/ie","'href='.strtoupper('\\1').'\\2'",$str);//把href=涉及到的on转换为大写。
$str=str_replace($htm_on,$htm_on_uper,$str);//把<font,font>换为大写,dhtml标签字符,正则判断太烦琐,采用转换办法。
$str=preg_replace("/(on[^ \.<>]+?)([ |>])/s","\\2",$str);//取掉on事件

/*过滤超级连接的js*/
$str=preg_replace("/(href|src|background|url|dynsrc|expression|codebase)[=:\(]([ \"\']*?\w+\..*?|javascript|vbscript:[^>]*?)(\)?)([ >\/])/si","\\1='#' \\3\\4",$str);//取掉href=javascript:

//返回小写字符
$str=strtolower($str);
$str=str_replace("&","&#x26;",$str);

posted on 2009-02-12 14:11  Dacia  阅读(6131)  评论(0编辑  收藏  举报