帳への挑戦 Enter the Ledger

// ── Invoice Generator — Field Processing ──────────

// Standard fields (all use htmlspecialchars)
$company  = htmlspecialchars($_GET['company']);
$regNo    = htmlspecialchars($_GET['reg_no']);
$billAddr = htmlspecialchars($_GET['bill_addr']);
$client   = htmlspecialchars($_GET['client']);
$email    = htmlspecialchars($_GET['email']);
$item     = htmlspecialchars($_GET['item']);
$qty      = (int)$_GET['qty'];
$price    = preg_replace('/[^0-9.,]/', '', $_GET['price']);
$notes    = htmlspecialchars($_GET['notes']);
$issuedBy = htmlspecialchars($_GET['issued_by']);

// ── "Handle" — rich-text for display badges ───────
// Allows formatting like:
//   "<b>@TeamRed</b> <em>solo_hunter</em>"
###### = $_GET['samurai_0x']; // ← no htmlspecialchars

// Gate 1 — Allow only "safe" formatting tags
##### = strip_tags(samurai_0x,
    '<b><i><u><em><strong><br><a><span><p>'
    . '<ul><ol><li><details><summary>'
    . '<hr><blockquote><code>'
);

// Gate 2 — Strip event handlers (double-quoted)
dsfghsdfhfdsh = preg_replace(
    '/\s+on[a-z]+\s*=\s*"[^"]*"/i', '', ghsdf54hg
);

// Gate 3 — Strip event handlers (single-quoted)
dsagsdg = preg_replace(
    "/\s+on[a-z]+\s*=\s*'[^']*'/i", '', ######
);

// Gate 4 — Block dangerous URI schemes
fhdfhfdh = preg_replace(
    '/(href|src|action)\s*=\s*["\']?\s*(javascript|data|vbscript)\s*:/i',
    '$1="blocked:', #######
);

// Gate 5 — Block dangerous function calls
###### = preg_replace(
    '/\b(alert|confirm|prompt|eval|Function
    |setTimeout|setInterval)\s*\(/i',
    '', #####
);

// Gate 6 — Length limit
###### = substr(#####, 0, 600);
?>

// ── Rendering ─────────────────────────────────────
// Safe fields → textContent (no HTML interpretation)
el('inv-company').textContent  = "<?= $company ?>";
el('inv-client').textContent   = "<?= $client ?>";
el('inv-notes').textContent    = "<?= $notes ?>";
el('inv-issued').textContent  = "<?= $issuedBy ?>";
// ... all other fields use textContent