Re: strip_tags

On Aug 12, 2008, at 2:01 PM, Richard Heyes wrote:

If you are sanitizing _POST input for a database by escaping (via mysql_*), is there a reason to use strip_tags()? If so, why and could you provide an example?

Not really, as long as you're using something like mysql_real_escape_string(). Though if you're redisplaying it to your users (ie something like a forum) then you might want to use strip_tags() to get rid of any HTML.

Actually, yes, the data is likely to be redisplayed to the users on a website. However, when shoving the data to the browser, I use htmlentities(). Is it recommended to use strip_tags() before sending to htmlentities()? ~Philip