Home/ Questions/Q 6588541
In Process

The Archive Base Latest Questions

Editorial Team
  • 0
Asked: 2026-05-25T17:03:40+00:00

I’m creating a mini-forum in PHP and I want to allow user posts with

  • 0

I’m creating a mini-forum in PHP and I want to allow user posts with limited text formatting and embedding images, but I want to do it securely (XSS-wise) and I was wondering what’s the most optimal approach of the ones below.

1) Strip all HTML tags from user input, and replace the WYSIWYG editor’s controls with BBCode. Is strip_tags sufficient for this?

2) Allow HTML input through the WYSIWYG, but use a parser to convert the output from HTML to BBCode. Can anyone recommend a secure BBCode parser for this?

Any other ideas are more than welcome.

Share

Leave an answer

You must login to add an answer.

Need An Account,

1 Answer

  1. Editorial Team

    You don’t need to parse or strip HTML to be secure. Just run everything through htmlspecialchars before you print it and you are safe.

    In addition, this is orthogonal to using BBcode. You can have your editor generate BBcode for formatting, and htmlspecialchars will not mess with it in any way.

    • 0