RE: [PHP] Cleaning user data
| From: | John W. Holmes | Date: | Thu, 20 Mar 2003 04:53:36 +0000 |
| Subject: | RE: [PHP] Cleaning user data | ||
| References: | 1 | Groups: | php.general |
| Request: | Send a blank email to php-general+get-140396@lists.php.net to get a copy of this message | ||
> And yes, definitely striptags(), and follow the advice on the rest of
the
> thread.
I disagree. I think stripping HTML from my text is a horrible thing. If
I want to put a <b> in my text, then use htmlentities() and show me a
<b> when I look at it. Obviously you don't want to "evaluate" HTML, but
the end result should be that I should see exactly what I typed into the
text box.
If you need to allow formatted text, then use something like BBcode
where you can specify exactly what is allowed.
---John W. Holmes...
PHP Architect - A monthly magazine for PHP Professionals. Get your copy
today. http://www.phparch.com/