Removing html, javascript etc from POST

Question

I got a simple script which I'm using to POST one world and then to display it with lines from list_of_files.txt. Just noticed that I can POST JavaScript, PHP and Html. How I strip this?

$files=file('list_of_files.txt');

if ($_SERVER['REQUEST_METHOD'] == 'POST'){ 
    foreach($files as $list)
    {
        $extension = $_POST['extension'];
        echo trim($list) . trim($extension);
        echo "</div>";
    }
}else{ 
?>

Look into htmlspecialchars() and strip_tags() manual pages — Alma Do
– Alma Do, Commented Aug 27, 2013 at 13:11

hresult · Accepted Answer · 2015-12-06 02:12:46Z

4

strip_tags($str) (http://php.net/manual/de/function.strip-tags.php) will remove ALL HTML tags

Example:

name=<strong>Finn</strong>&last_name=<script>alert('XSS');</script>

PHP:

$normal = $_POST['name']; //<strong>Adam</strong>
$stripped = strip_tags($_POST['name']); //Adam

edited Dec 6, 2015 at 2:12

answered Aug 27, 2013 at 13:13

hresult

3012 silver badges17 bronze badges

Sign up to request clarification or add additional context in comments.

Comments

Brad Christie · Accepted Answer · 2013-08-27 13:11:18Z

3

Are you looking for strip_tags?

This function tries to return a string with all NULL bytes, HTML and PHP tags stripped from a given str. It uses the same tag stripping state machine as the fgetss() function.

if you're looking to output, you can use htmlspecialchars.

The translations performed are:

   '&' (ampersand) becomes '&amp;'
   '"' (double quote) becomes '&quot;' when ENT_NOQUOTES is not set.
   "'" (single quote) becomes '&#039;' (or &apos;) only when ENT_QUOTES is set.
   '<' (less than) becomes '&lt;'
   '>' (greater than) becomes '&gt;'

answered Aug 27, 2013 at 13:11

Brad Christie

102k16 gold badges160 silver badges200 bronze badges

Collectives™ on Stack Overflow

Removing html, javascript etc from POST

2 Answers 2

Comments

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Related