Question

In a PHP script I’m accepting input from the user from a textarea and want to allow a few basic tags. So when I output the string I’m using –

echo strip_tags($content, '<b><i><ul><ol><li>');

Now normally I would use FILTER_SANITIZE_STRING but that would strip all tags and I would use html_entities() but that would prevent the tags I’m passing through from displaying as they should.

So what else do I need to strip or encode and how do I do that?

Answer 1

I don’t think you can rely on strip_tags() for security purposes – from http://php.net/strip_tags:

This function does not modify any
attributes on the tags that you allow
using allowable_tags , including the
style and onmouseover attributes that
a mischievous user may abuse when
posting text that will be shown to
other users.

It might be better to look at something like HTML Purifier or PEAR HTML_Safe, which should be able to do exactly what you want.