Edit report at https://bugs.php.net/bug.php?id=66111&edit=1
ID: 66111
Comment by: anon at anon dot anon
Reported by: 22rist at gmail dot com
Summary: strip_tags strip <=
Status: Open
Type: Bug
Package: Filter related
Operating System: windows 7 x64
PHP Version: 5.5Git-2013-11-18 (Git)
Block user comment: N
Private report: N
New Comment:
Why would someone write that?
Oh wait, you just did. Can you imagine how annoying it would be for you to type your comment if this
bug page used strip_tags?
Previous Comments:
------------------------------------------------------------------------
[2013-11-20 13:35:03] 22rist at gmail dot com
Ok, htmlspecilachars will prevent XSS. But I want to STRIP TAGS.
I want to see
"Please use google.com"
when user write
"<b>Please</b> use <a href="https://www.google.com">google.com</a>"
AND NOT an encoded variant of "<b>Please</b> use <a href="https://www.google.com">google.com</a>"
as htmlspecilachars do.
------------------------------------------------------------------------
[2013-11-20 13:17:15] anon at anon dot anon
There's a very easy way to prevent XSS and allow "Mileage <= 15000". It's
called htmlspecialchars.
------------------------------------------------------------------------
[2013-11-20 12:23:45] 22rist at gmail dot com
In security reasons (to prevent XSS) I should strip all tags in user comments. It's not a
developer blog and there wont be conversation about HTML.
And your comment "they want to talk about HTML." is not related to the subject.
The subject is "The function strip_tags should strip tags and only tags".
------------------------------------------------------------------------
[2013-11-20 12:12:16] anon at anon dot anon
>There can be tags that I must strip.
In other words, you're trying to make it a nuisance for anyone on the off chance they want to
talk about HTML.
strip_tags is the wrong function. Use htmlspecialchars.
------------------------------------------------------------------------
[2013-11-19 14:18:59] 22rist at gmail dot com
This text can be in comments. Some of this comments can be from user. There can be tags that I must
strip. But there can be "Mileage <= 15000" that I shouldn't streep. What should I
do?
------------------------------------------------------------------------
The remainder of the comments for this report are too long. To view
the rest of the comments, please view the bug report online at
https://bugs.php.net/bug.php?id=66111--
Edit this bug report at https://bugs.php.net/bug.php?id=66111&edit=1