CODEWITHSUNDEEP
php
Jatt
Jatt

Reputation:

PHP: How can I disallow HTML content in user-generated content?

I run a niche social network site. I would like to disallow HTML content in user posted messages; such as embedded videos etc. what option is there in php to clean this up before I insert into the db.

Upvotes: 7

Views: 229

Answers (2)

DisgruntledGoat
DisgruntledGoat

Reputation: 72580

There are three basic solutions:

  1. Strip all HTML tags from the post. In PHP you can do this using the strip_tags() function.
  2. Encode all the characters, so that if a user types <b>hello</b> it shows up as &lt;b&gt;hello&lt;/b&gt; in the HTML, or <b>hello</b> on the page itself. In PHP this is the htmlspecialchars() function. (Note: in this situation you would generally store the content in the database as-is, and use htmlspecialchars wherever you output the content.)
  3. Use a HTML sanitizer such as HTML Purifier. This allows users to use certain HTML formatting such as bold/italic, but blocks malicious Javascript and any other tags you wish (i.e. <object> in your case). You may or may not wish to do this before storing in the database, but you must always do it before output in either case.

Upvotes: 14

stealthyninja
stealthyninja

Reputation: 10371

You could use the strip_tags() function.

Upvotes: 3

Related Questions