note 21249 deleted from function.strip-tags by nlopess
| From: | nlopess@php.net | Date: | Thu, 11 Mar 2004 14:53:24 +0000 |
| Subject: | note 21249 deleted from function.strip-tags by nlopess | ||
| References: | 1 | Groups: | php.notes |
| Request: | Send a blank email to php-notes+get-66643@lists.php.net to get a copy of this message | ||
Note Submitter: bec@quietly.zzn.com
----
strip_tags() doesn't remove lone opening comment tags (like so: <!-- )
if you are getting user input (via a form, or what), someone can put in a "<!--"
(without the closing tag) and the rest of the html on that page will not show. to catch these:
$stuff = strip_tags($stuff);
$stuff = str_replace('<!--', '', $stuff);