How to filter out Dangerous HTML like SO?

Question

I want to provide an HTML editor on my site, but I do not want to open myself up to xss or other attacks that come with custom HTML.

This is very similar to what Stack Overflow does. How HTML is checked / cleared here, so that styling information remains, while other, more dangerous things (such as javascript, iframe, etc.) are not used?

Are there any libraries (preferably in PHP) that already do this?

Answer 1

PHP has a strip_tags function that removes HTML and PHP tags from a string and allows you to specify specific valid tags. But, as @webarto , there are libraries that make this better.

From the PHP manual .

Answer 2

you can use

 strip_tags($yourData,"<a><p><div><i>") // more tags you want to keep; 

If your SQL usage also uses

 mysql_real_escape_string($data); 

This is really all you do not need to enter. Keep in mind that when using real mySQL rescue, you need to use strip slashes to remove them when you echo them.

Here are the docs for strip tags and docs for mysql escape .

Answer 3

If you want to allow some (X) HTML and restrict only those tags that are considered unsafe, you can use something like KSES. Wordpress uses such a solution.

http://sourceforge.net/projects/kses/

Answer 4

In addition to Whymarrh's publication, it is recommended that you use the code in a subfolder of your site and automatically change any code that has ".." or "http: //" or any mysql commands.