note 118183 added to function.strip-tags

A word of caution. strip_tags() can actually be used for input validation as long as you remove ANY tag. As soon as you accept a single tag (2nd parameter), you are opening up a security hole such as this: <acceptedTag onLoad="javascript:malicious()" /> Plus: regexing away attributes or code block is really not the right solution. For effective input validation when using strip_tags() with even a single tag accepted, http://htmlpurifier.org/ is the way to go. ---- Server IP: 72.52.91.14 Probable Submitter: 91.143.197.54 ---- Manual Page -- http://php.net/manual/en/function.strip-tags.php Edit -- https://master.php.net/note/edit/118183 Del: integrated -- https://master.php.net/note/delete/118183/integrated Del: useless -- https://master.php.net/note/delete/118183/useless Del: bad code -- https://master.php.net/note/delete/118183/bad+code Del: spam -- https://master.php.net/note/delete/118183/spam Del: non-english -- https://master.php.net/note/delete/118183/non-english Del: in docs -- https://master.php.net/note/delete/118183/in+docs Del: other reasons-- https://master.php.net/note/delete/118183 Reject -- https://master.php.net/note/reject/118183 Search -- https://master.php.net/manage/user-notes.php