Question

I am using a rich text box in my application and am looking at ways to clean the input before storing it in a database. Because I want to allow some HTML through I was thinking of using strip_tags with the allowed tags specified, something like this:

public function cleanRichInput($text)
{
    return strip_tags(trim($text),"<a><div><p><strong>");
}

That seems kind of cumbersome though, could anyone suggest a better way to handle input where you want some HTML to get through? Any advice would be appreciated, thanks!

Answer 1

This is actually a pretty straight-forward way already. I would suggest you use strip_tags with the optional permitted tags parameter. Keep in mind though that this does not strip out attributes on tags.

If you want something a bit more complicated, you could check out the HTML Purifier. This method, like the last, permits you to define which elements are allowed. Beyond the ability of the strip_tags function, HTML Purifier also lets you provide a collection of allowable attributes.