Edit report at https://bugs.php.net/bug.php?id=66111&edit=1
ID: 66111
Comment by: 22rist at gmail dot com
Reported by: 22rist at gmail dot com
Summary: strip_tags strip <=
Status: Open
Type: Bug
Package: Filter related
Operating System: windows 7 x64
PHP Version: 5.5Git-2013-11-18 (Git)
Block user comment: N
Private report: N
New Comment:
The subject is "The function strip_tags should strip tags and only tags".
Not "How I use strip_tags". Or "how somebody filter comments".
So if you can't write something related to the subject please do not spam.
Previous Comments:
------------------------------------------------------------------------
[2013-11-20 13:59:45] anon at anon dot anon
Why would someone write that?
Oh wait, you just did. Can you imagine how annoying it would be for you to type your comment if this
bug page used strip_tags?
------------------------------------------------------------------------
[2013-11-20 13:35:03] 22rist at gmail dot com
Ok, htmlspecilachars will prevent XSS. But I want to STRIP TAGS.
I want to see
"Please use google.com"
when user write
"<b>Please</b> use <a href="https://www.google.com">google.com</a>"
AND NOT an encoded variant of "<b>Please</b> use <a href="https://www.google.com">google.com</a>"
as htmlspecilachars do.
------------------------------------------------------------------------
[2013-11-20 13:17:15] anon at anon dot anon
There's a very easy way to prevent XSS and allow "Mileage <= 15000". It's
called htmlspecialchars.
------------------------------------------------------------------------
[2013-11-20 12:23:45] 22rist at gmail dot com
In security reasons (to prevent XSS) I should strip all tags in user comments. It's not a
developer blog and there wont be conversation about HTML.
And your comment "they want to talk about HTML." is not related to the subject.
The subject is "The function strip_tags should strip tags and only tags".
------------------------------------------------------------------------
[2013-11-20 12:12:16] anon at anon dot anon
>There can be tags that I must strip.
In other words, you're trying to make it a nuisance for anyone on the off chance they want to
talk about HTML.
strip_tags is the wrong function. Use htmlspecialchars.
------------------------------------------------------------------------
The remainder of the comments for this report are too long. To view
the rest of the comments, please view the bug report online at
https://bugs.php.net/bug.php?id=66111--
Edit this bug report at https://bugs.php.net/bug.php?id=66111&edit=1