All geek questions in one place

Prevent XSS but still allow some HTML in PHP

I want to block XSS attacks, but I still want to allow HTML tags such as <b><u><i><img><a> and YouTube video players. I do not want to be open to XSS attacks. I am using PHP.

+1
source share
2 answers

I recommend using htmlpurifier , it is the safest html filtering tool.

I suggest you also read an excellent analysis of sanistisation tools for PHP .

+3
source 
 strip_tags($string, "<b> <u> <i> <img> <a>");

This will not stop anyone from using onmouseover, etc., though - you need to disable Javascript.

+1
source

Source: https://habr.com/ru/post/1440387/

More articles:


All Articles