Are there any best practices for securely filtering HTML tags from a string in PHP?

When accepting user input that contains HTML tags, it's important to sanitize the input to prevent cross-site scripting (XSS) attacks. One common approach is to use PHP's strip_tags() function to remove all HTML and PHP tags from the input string, leaving only the text content. 

// Input string containing HTML tags
$input = '<p>This is a <b>bold</b> text with a <script>alert("XSS")</script> attack</p>';

// Sanitize the input by removing all HTML and PHP tags
$clean_input = strip_tags($input);

echo $clean_input;

Keywords

htmlspecialchars strip_tags filter_var htmlentities XSS

Related Questions