Question

How can I stop users entering <?php ?> into my forms.

I am using urlencode() and then using urldecode() when echoing data onto my page what is the best thing to do??

UPDATE:

I am writing to the database with the text urlencoded:

htmlentities (urlencode($_POST['postmessage']));

I am using:

<?php echo htmlentities (urldecode($row['content'])) ?>

to echo the saved data. Is that enough??

Answer 1

I would suggest you to use the HTML Purifier for that:

HTML Purifier is a standards-compliant
HTML filter library written in PHP.
HTML Purifier will not only remove all
malicious code (better known as
XSS) with a thoroughly audited,
secure yet permissive whitelist, it
will also make sure your documents are
standards compliant, something only
achievable with a comprehensive
knowledge of W3C’s specifications.