note 36040 added to function.strip-tags

In response to the question... ----- So, what happens if I submit <scr<script></script>ipt>alert(1)</scr<script></script>ipt>? Your parsers will remove <script></script> and leave with: <script>alert(1)</script> Which will still execute the javascript code if the string is printed to the web browser. ----- To prevent the code from being executed do this... $script_kiddie = "<scr<script></script>ipt>alert(1)</scr<script></script>ipt>"; echo htmlentities(strip_tags($script_kiddie)); The result will print their attempt at zapping your forum or guest book with javascript. Instead you will see the code they were trying to display. ---- Manual Page -- http://www.php.net/manual/en/function.strip-tags.php Edit Note -- http://master.php.net/manage/user-notes.php?action=edit+36040 Delete Note -- http://master.php.net/manage/user-notes.php?action=delete+36040&report=yes Reject Note -- http://master.php.net/manage/user-notes.php?action=reject+36040&report=yes