CODEWITHSUNDEEP
phpxss
Keverw
Keverw

Reputation: 3786

Preventing XSS but still allowing some HTML in PHP

I want to block XSS attacks but I still want to allow HTML tags like <b><u><i><img><a> and YouTube video players. I don't want to be open for XSS attacks tho. I am using PHP.

Upvotes: 1

Views: 532

Answers (2)

Nicol&#242; Martini
Nicol&#242; Martini

Reputation: 5220

I recommend using htmlpurifier, it is the most secure tool to filter html.

I suggest you also to read this great analysis of HTML sanistisation tools for php.

Upvotes: 3

Thomas O
Thomas O

Reputation: 6220

strip_tags($string, "<b> <u> <i> <img> <a>");

This will not prevent someone from using onmouseover etc. though - you have to strip out Javascript.

Upvotes: 1

Related Questions