Question

When I get text from database it can contain things like <h1> <div> etc… This can be entered by user and screw things up on a website, so I need to filter them out.

I tried to apply this method: http://www.w3schools.com/php/filter_sanitize_special_chars.asp

Here is what I have now, but it does not work.

            $story_title = $row["st_title"]; // Gathered from Database
            filter_var($story_title,FILTER_SANITIZE_SPECIAL_CHARS);
            $story_category = $row["st_category"]; // Gathered from Database
            filter_var($story_category,FILTER_SANITIZE_SPECIAL_CHARS);
            $the_story = $row["st_body"]; // Gathered from Database
            filter_var($story_body,FILTER_SANITIZE_SPECIAL_CHARS);

Can anyone sugges a solution that would work?

Answer 1

If you want to remove the html tags you can use a built in function strip_tags()

Example:

$userdata = "<h1>This is a title <a href=\"http://www.example.com\">and a link</a> </h1>";
echo strip_tags($userdata);
// will echo "This is a title and a link";

You can allow some tags if you want:

$userdata = "<h1>This is a title <a href=\"http://www.example.com\">and a link</a> </h1>";
echo strip_tags($userdata,"<a>");
// will echo "This is a title and <a href=\"http://www.example.com\">and a link</a>";
// the anchor tag is not removed