note 36040 deleted from function.strip-tags by didou

Note Submitter: amn -at- f.r.o.g.n.e.t.net ---- In response to the question... ----- So, what happens if I submit <scr<script></script>ipt>alert(1)</scr<script></script>ipt>? Your parsers will remove <script></script> and leave with: <script>alert(1)</script> Which will still execute the javascript code if the string is printed to the web browser. ----- To prevent the code from being executed do this... $script_kiddie = "<scr<script></script>ipt>alert(1)</scr<script></script>ipt>"; echo htmlentities(strip_tags($script_kiddie)); The result will print their attempt at zapping your forum or guest book with javascript. Instead you will see the code they were trying to display.