Remove javascript from user input but still allow html with PHP?

Question

I want to allow users to write html into a form field but exclude javascript. Is there simple code or a library that will do this?

I've looked into using HTML Purifer but I'm not quite sure how to configure it to run in the way I am looking for. I think I would have to specify all the tags that I am allowing into HTML.allowed. I could come up with an exhaustive list, I guess, but if there is an easier way, I'd rather do that.

Capsule · Accepted Answer · 2017-07-26 05:54:32Z

2

strip_tags() takes a second argument $allowable_tags so no need for external libraries or classes but yes, you will have to allow any tags you want to allow. Honestly, there are not so many tags. You may also want to disallow <style>

http://php.net/manual/fr/function.strip-tags.php

edited Jul 26, 2017 at 5:54

answered Apr 4, 2011 at 18:50

Capsule

6,1531 gold badge24 silver badges28 bronze badges

Sign up to request clarification or add additional context in comments.

2 Comments

Quentin Over a year ago

… and <object>, <applet>, <iframe> since they can all load JS. You also need to watch out for javascript: URIs, and so on.

Sameer Parwani Over a year ago

I've heard bad things about strip_tags like it totally screws up when the html is not perfect syntax wise and that you can get around it by using things like onclick on allowed tags.

Collectives™ on Stack Overflow

Remove javascript from user input but still allow html with PHP?

1 Answer 1

2 Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

2 Comments

Your Answer

Sign up or log in

Post as a guest

Related