function messagehtml($input)
{
# convert user textarea post to formatted html
+ global $User;
if (empty($input)) {
return;
}
- $html = htmlspecialchars($input);
- $html = preg_replace('"(?:<br />){2}"', "</p>\n\n<p>", nl2br($html));
+ if ($User->admin and preg_match('/\A<[a-z][^>]*>/', $input)) {
+ return $input; # allow html input as is if privileged
+ }
+ $html = preg_replace(
+ ["/\r?\n/", "'(?:<br />\n?){2}'"],
+ ["<br />\n", "</p>\n\n<p>"],
+ htmlspecialchars($input)
+ );
return "<p>$html</p>";
}