Bug #66111 [Com]: strip_tags strip <=

Edit report at https://bugs.php.net/bug.php?id=66111&edit=1 ID: 66111 Comment by: 22rist at gmail dot com Reported by: 22rist at gmail dot com Summary: strip_tags strip <= Status: Open Type: Bug Package: Filter related Operating System: windows 7 x64 PHP Version: 5.5Git-2013-11-18 (Git) Block user comment: N Private report: N New Comment: Ok, htmlspecilachars will prevent XSS. But I want to STRIP TAGS. I want to see "Please use google.com" when user write "<b>Please</b> use <a href="https://www.google.com">google.com</a>" AND NOT an encoded variant of "<b>Please</b> use <a href="https://www.google.com">google.com</a>" as htmlspecilachars do. Previous Comments: ------------------------------------------------------------------------ [2013-11-20 13:17:15] anon at anon dot anon There's a very easy way to prevent XSS and allow "Mileage <= 15000". It's called htmlspecialchars. ------------------------------------------------------------------------ [2013-11-20 12:23:45] 22rist at gmail dot com In security reasons (to prevent XSS) I should strip all tags in user comments. It's not a developer blog and there wont be conversation about HTML. And your comment "they want to talk about HTML." is not related to the subject. The subject is "The function strip_tags should strip tags and only tags". ------------------------------------------------------------------------ [2013-11-20 12:12:16] anon at anon dot anon >There can be tags that I must strip. In other words, you're trying to make it a nuisance for anyone on the off chance they want to talk about HTML. strip_tags is the wrong function. Use htmlspecialchars. ------------------------------------------------------------------------ [2013-11-19 14:18:59] 22rist at gmail dot com This text can be in comments. Some of this comments can be from user. There can be tags that I must strip. But there can be "Mileage <= 15000" that I shouldn't streep. What should I do? ------------------------------------------------------------------------ [2013-11-19 13:10:30] anon at anon dot anon strip_tags converts HTML to plain text. If you're typing "Mileage <= 15000", that's not HTML, it's text, so strip_tags is the wrong function. Use htmlspecialchars. ------------------------------------------------------------------------ The remainder of the comments for this report are too long. To view the rest of the comments, please view the bug report online at https://bugs.php.net/bug.php?id=66111 -- Edit this bug report at https://bugs.php.net/bug.php?id=66111&edit=1