How can one ensure that only HTML tags are preserved while filtering out PHP commands in PHP code?

To ensure that only HTML tags are preserved while filtering out PHP commands in PHP code, you can use the strip_tags() function in PHP. This function allows you to specify which HTML tags should be allowed, while removing any PHP code present in the input. 

$input = "<p>Hello, <?php echo 'World'; ?></p>";
$cleaned_input = strip_tags($input, "<p><a><strong><em>");
echo $cleaned_input;

Keywords

strip_tags htmlspecialchars htmlentities filter_var XSS

Related Questions