I just threw together a simple tag extension to embed a twitter live stream search widget
in a wiki page. It just takes the following parameters from $input:
These get dropped into a <script> that is returned. It works, but now I'm
wondering what I should do to sanitize the values of title, subject, and query. I
don't want to just use In the js, the values are all inside single quotes. I was
thinking that I would use strip_tags combined with substituting single quotes with
preg_replace('/\W/', '', $t)
would disallow hashtags and @'s, right?
Dept. of Biochemistry and Biophysics
Texas A&M Univ.
College Station, TX 77843-2128