Re: Re: security in guest book and user forums

The bad side of this that all other HTML tags than <b> and <i> will be removed. > on 05/01/03 5:24 AM, Seraphim (h.b.oost@student.utwente.nl) wrote: > > > I use the htmlspecialchars() function to disable all html. This function > > basically puts a '\' in front of eacht html character and thus disables all > > html. > > You may not want to do this if you want to allow, for example <b></b> or > > other friendly html. If so you can use a regex to disable the <script> or > > </table> tags. > > > > Now that I think about it, it might be better to disable all html and later > > enable <i>,<b> etc (or define your own, like a lot of forums seem to do). > > What about striptags()? Designed EXACTLY for disabling HTML tags, except for > a list you allow: > > <? > $text = stiptags($text,'<b><i>'); // allows bold and italics > ?> > > Justin > >