<?php
if (!function_exists('sanitize_textarea')) {
    /**
     * Sanitize multiline text to allow newlines but strip HTML tags.
     *
     * @param string $text The text to sanitize.
     * @return string The sanitized text.
     */
    function sanitize_textarea($text)
    {
        // Replace newlines with a temporary placeholder
        $text = str_replace("\n", "{{NEWLINE}}", $text);

        // Strip all HTML tags
        $text = strip_tags($text);

        // Restore newlines
        $text = str_replace("{{NEWLINE}}", "\n", $text);

        return $text;
    }
}
if (!function_exists('sanitize_editor')) {
    /**
     * Sanitize TinyMCE input by allowing only specific HTML tags and attributes.
     *
     * @param string $input The HTML input to sanitize.
     * @return string The sanitized HTML output.
     */
    function sanitize_editor($input)
    {
        // Allow only specific tags
        $allowed_tags = '<p><a><b><strong><i><ul><ol><li><br><img>';
        $clean = strip_tags($input, $allowed_tags);
        
        // Remove JavaScript attributes (onclick, onmouseover, etc.)
        $clean = preg_replace('/on[a-zA-Z]+="[^"]*"/', '', $clean);
        
        // Remove javascript: from href or src
        $clean = preg_replace('/javascript:/i', '', $clean);

        return $clean;
    }
}
if (!function_exists('sanitize_iframe')) {
    /**
     * Sanitize iframe code to allow only specific attributes.
     *
     * @param string $iframeCode The iframe code to sanitize.
     * @return string The sanitized iframe code.
     */
    function sanitize_iframe($iframeCode)
    {
        // List of allowed iframe attributes
        $allowedAttributes = [
            'src',
            'width',
            'height',
            'frameborder',
            'allow',
            'allowfullscreen',
            'loading',
            'referrerpolicy',
            'title',
        ];

        // Create a new DOMDocument instance
        $dom = new DOMDocument();

        // Suppress warnings for invalid HTML
        libxml_use_internal_errors(true);

        // Load the iframe code into the DOMDocument
        $dom->loadHTML($iframeCode, LIBXML_HTML_NOIMPLIED | LIBXML_HTML_NODEFDTD);

        // Clear any errors
        libxml_clear_errors();

        // Find all iframe elements
        $iframes = $dom->getElementsByTagName('iframe');

        foreach ($iframes as $iframe) {
            // Remove all attributes not in the allowed list
            foreach ($iframe->attributes as $attribute) {
                if (!in_array($attribute->name, $allowedAttributes)) {
                    $iframe->removeAttribute($attribute->name);
                }
            }

            // Ensure the src attribute is a valid URL
            if ($iframe->hasAttribute('src')) {
                $src = $iframe->getAttribute('src');
                if (!filter_var($src, FILTER_VALIDATE_URL)) {
                    $iframe->removeAttribute('src');
                }
            }
        }

        // Save the sanitized iframe code
        $sanitizedIframe = $dom->saveHTML();

        return $sanitizedIframe;
    }
}