"\']/', $plain)) { return ''; } if (!preg_match('#^(https?://[^/]+|/(?!/))#i', $plain)) { return ''; } return htmlspecialchars($plain, ENT_QUOTES, 'UTF-8'); } function znote_bbcode_color(string $color): string { $plain = trim(html_entity_decode($color, ENT_QUOTES, 'UTF-8')); if (preg_match('/^#[0-9a-f]{3,8}$/i', $plain)) return $plain; if (preg_match('/^[a-z]{3,20}$/i', $plain)) return strtolower($plain); if (preg_match('/^rgba?\(\s*[0-9]{1,3}\s*,\s*[0-9]{1,3}\s*,\s*[0-9]{1,3}\s*(,\s*(0|1|0?\.[0-9]+)\s*)?\)$/i', $plain)) return $plain; return ''; } /** * For text stored WITHOUT HTML escaping - news and changelog, which the admin * panel writes through esc() (SQL escaping only). Escaping here means an admin * typing