note 100777 added to function.strip-tags

If you are using strip_tags() to filter input HTML, keep in mind the warning that if you ever display the content to a user in a web browser without calling htmlspecialchars(), you have likely introduced a security vulnerability on your website. As an added bonus, if you call strip_tags() with ANY options in the second parameter, you are saying, "please hack my website!" to all the script kiddies out there. strip_tags() is the poor-man's HTML Purifier: http://htmlpurifier.org/comparison HTML Purifier isn't the fastest solution and even the author admits it isn't perfect at what it is supposed to do but I've found that it is infinitely better than anything else out there - including the various comments here with people trying to "improve" a clearly BROKEN function (strip_tags() is broken folks). The real question is: How important is security to you on your website? I have no affiliation with HTML Purifier other than I'm a satisfied user who has yet to have a site be hacked that uses HTML Purifier. Every time I've used strip_tags(), I've been burned with XSS exploits. strip_tags() should either be deprecated and removed from PHP or completely rewritten from the ground up. It was fine maybe 7 to 10 years ago, but is a broken function by today's standards. ---- Server IP: 64.71.164.2 Probable Submitter: 169.197.2.6 ---- Manual Page -- http://www.php.net/manual/en/function.strip-tags.php Edit -- https://master.php.net/note/edit/100777 Del: integrated -- https://master.php.net/note/delete/100777/integrated Del: useless -- https://master.php.net/note/delete/100777/useless Del: bad code -- https://master.php.net/note/delete/100777/bad+code Del: spam -- https://master.php.net/note/delete/100777/spam Del: non-english -- https://master.php.net/note/delete/100777/non-english Del: in docs -- https://master.php.net/note/delete/100777/in+docs Del: other reasons-- https://master.php.net/note/delete/100777 Reject -- https://master.php.net/note/reject/100777 Search -- https://master.php.net/manage/user-notes.php