Question

i have user data from database that parse inside p element. if user data contain </p> to begin with. my p element will be close. how to make the html render and prevent user data manipulating p element?

<p style="overflow:auto; position:relative; width:600; height:290;border-width: 1px; border-style: solid; border-color: grey;">

<print user data here>

</p>

Answer 1

You have bigger problems than the p tag closing incorrectly if you just output user data without checking it first – you need to strip out all unsafe (if not all) HTML tags, especially <script> tags.

If you’re using PHP for example,

strip_tags('<p>blah</p> <script>dangerousScript()</script>')

will produce: “blah dangerousScript()”, getting rid of both the <p> and the <script>.

You can supply a list of allowable tags too, if say you want to allow images:

strip_tags('<p>blah</p> <script>dangerousScript()</script>', '<img>')