Question

I want to use htmlspecialchars on user’s textarea, but I want him to allow to use bold and italic. How can I not use htmlspecialchars on those tags?

Answer 1

Use the better-safe-than-sorry method. That is you first apply htmlspecialchars, and then very selectively undo it / whitelist your two tags:

 $html = htmlspecialchars($html);
 $html = preg_replace('#&lt;(/?[bi])&gt;#', '<$1>', $html);

That works only when those tags only contain those exact two strings, no extra attributes. No safety or consistency concerns with that however (except that this short version doesn’t assert balanced tags, ooops).

If you need more complex rules, then HTMLPurifier is what you should look out for.