Re: [PHP4BETA] Re: strip_tags() and the recent CERT advisory....

TG>> memcpy(). But I'm not about to benchmark them :-) If anyone wants to do TG>> that and post results, I'd be interested. Well, why not? Should take not much time... Will check it. TG>> However, htmlentities() only works with ISO-8859-1 character set. If the TG>> browser in question is submitting data to the script in another character TG>> set, htmlentities() does nothing to it, or worse, the wrong thing (because TG>> it assumes its ISO-8859-1 even if it is not). In fact, I meant htmlspecialchars(), not entities. My fingers just typed wrong function names, sorry. I think even, I don't really care for anything except < (so I could just remove all <'s - it would effectively disable HTML, IIRC, but I really want to be nice to users and do something well-defined). In fact, the only question is doesn't some browser recognise any other character as HTML tag start? Then, btw, strip_tags won't work too, as I understand. -- Stanislav Malyshev stas@zend.com +972-3-6139665