Symfony3-如何验证HTML标记

您可以在实体中的文本/字符串属性上使用regex进行断言。例如,这将阻止字符串中的任何HTML标记:

// src/Entity/Thing.php
namespace App\Entity;

use Symfony\Component\Validator\Constraints as Assert;

class Thing
{
    /**
     * @Assert\Regex(
     *     pattern="/<[a-z][\s\S]*>/i",
     *     match=false,
     *     message="Your text cannot contain HTML"
     * )
     */
    protected $text;
}

// src/Entity/Thing.php
namespace App\Entity;

use Symfony\Component\Validator\Constraints as Assert;

class Thing
{
    /**
     * @Assert\Regex(
     *     pattern="/<(?=.*? .*?\/ ?>|textarea|input)[a-z]+.*?>|<([a-z]+).*?<\/\1>/i",
     *     match=false,
     *     message="Your text cannot contain certain HTML tags"
     * )
     */
    protected $text;
}

你也可以用 strip_tags

public function setText()
{
    $this->text = strip_tags($text);
    return $this;
}