Question

I’m away from a computer with PHP installed and was wondering what the result of strip_tags() would be on the following text:
“<scr<h1>ipt>alert(‘oh oh’)</scr</h1>ipt>”

Would it return:
“<script>alert(‘oh oh’)</script>” (i.e. not recognize that by removing the obvious tag it exposed a new one)
or
“alert(‘oh oh’)

I know that if it returns the first case I can just repeatedly call the function until I get out what I put in, but I’m curious.

Thanks in advance.

Answer 1

Great question.

Nope, it doesn’t strip anything from that string:

<?php
$b = "ipt>alert('oh oh')ipt>";
echo strip_tags($b);
?>

And the output is your original string: ipt>alert('oh oh')ipt>

Edit

In your second case it will print alert('oh oh') so it strips all that is looking like a tag in a single step