PHP strip_tags does not allow less than '<' in string

Question

Please let me know how to resolve less than the '<' strip_tags() in strip_tags()

Code snippet

 $string ="abc<123"; StringFromUser($string); function StringFromUser($string) { if (is_string($string)) { return strip_tags($string); } } 

Output: abc

Expected output abc <123

Answer 1

First encode it correctly.

 $string ="abc<123"; 

Although if you do not sanitize the HTML output, you should still not use strip_tags() .

Answer 2

strip_tags is a fairly simple and not very good way to sanitize data (i.e., "randomly changing arbitrary values ​​in a form"). Again, this is not a good feature, as you can see. You should only sanitize the data, if you have good reason, often there is no good reason. Ask yourself what you get from the arbitrary removal of parts of the value.

You either want to check or avoid to avoid syntax problems and / or injections. Sanitation is rarely correct. Read The Great Escapism (or: what you need to know in order to work with text inside the text) for more information on the whole topic.

Answer 3

You can search for a character in your string, pull it out, strip_tags () in your string and return the character:

 $string = "abc<123"; $character = "<"; $pos = strpos($string,$character); $tag = ">"; $check = strpos($string,$tag); if ($pos !== false && $check == false) { $string_array = explode("<",$string); $string = $string_array[0]; $string .= $string_array[1]; $string = strip_tags($string); $length = strlen($string); $substr = substr($string, 0, $pos); $substr .= "<"; $substr .= substr($string, $pos, $length); $string = $substr; } else { $string = strip_tags($string); } 

or you can use preg_replace () to replace all the characters you don't want in your $ string.

Answer 4

 $string = "abc<123"; echo StringFromUser($string); function StringFromUser($string) { if (is_string($string)) { //change "abc<123" to "abc< myUniqueID123", so math expressions are not stripped. //use myQuniqueID to identity what we have changed later. $string = preg_replace("/(<)(\d)/", "$1 myUniqueID$2", $string); $string = strip_tags($string); //change "abc< myUniqueID123" back to "abc<123" $string = preg_replace("/(<) myUniqueID(\d)/", "$1$2", $string); return $string; } }