note 88179 added to function.strip-tags

I think it is worth mentioning that if some tags are allowed using the second parameter, this function does not allow to strip attributes within the allowed tags and hence should not be used against XSS vulnerabilities. One can still execute javascript by 2 means: - by inserting attributes that typically accept javascript >> onClick="alert('XSS');" - by using styles >> style="width:expression(alert('XSS'));" (works on IE7 and probably >> other versions) ---- Server IP: 208.69.120.35 Probable Submitter: 64.19.237.107 ---- Manual Page -- http://www.php.net/manual/en/function.strip-tags.php Edit -- https://master.php.net/note/edit/88179 Del: integrated -- https://master.php.net/note/delete/88179/integrated Del: useless -- https://master.php.net/note/delete/88179/useless Del: bad code -- https://master.php.net/note/delete/88179/bad+code Del: spam -- https://master.php.net/note/delete/88179/spam Del: non-english -- https://master.php.net/note/delete/88179/non-english Del: in docs -- https://master.php.net/note/delete/88179/in+docs Del: other reasons-- https://master.php.net/note/delete/88179 Reject -- https://master.php.net/note/reject/88179 Search -- https://master.php.net/manage/user-notes.php