Question

Hey guy’s i’m making a website which involves submiting an ad for a gameserver. I’m wondering if it is possible to strip PHP related tags from the content of the textbox? As if I leave it how it is now, It may become a security risk later on. Currently the only thing I am doing to the content is nl2br(). What is the best way to do this?

Thanks.

Answer 1

1. Why do you care about php code in textbox, can it be executed in any way?
2. I suppose that you want to leave html tags but remove just php code (in other case you could just use strip_tags function or htmlspecialchars).

So, the solution:

<?php
//here is content from the textarea (filled it for example)
$content = 'some <?php echo "test"; ?> <?=test?> content <br/> here';

$content = preg_replace('/<\?((?!\?>).)*\?>/s', '', $content); //strip all the php code