Question

Ok, now I have a dilemma, I need to allow users to insert raw HTML but also block out all JS – not just script tags but from the href etc. at the moment, all I know of is

htmlspecialchars($string, ENT_QUOTES, 'UTF-8');

But this also converts valid tags into encoded characters. If I use striptags, it also doesn’t work as it removes tags! (I know that you can allow tags but the thing is if I allow any tags such as <a></a> people can add malicious JS to it.

Is there anything I can do to allow html tags but without the XSS injection? I have planned a function: xss() and have setup my site’s template with that. It returns the escaped string. (I just need help with escaping :))

Thanks!

Answer 1

Related: Preventing XSS but still allowing some HTML in PHP

Example code from HTMLPurifier Docs:

require_once '/path/to/HTMLPurifier.auto.php';

$config = HTMLPurifier_Config::createDefault();
$purifier = new HTMLPurifier($config);
$clean_html = $purifier->purify($dirty_html);

You can use that code as a reference in your xss(...) method.