Try strip_tags to get rid of any html submitted. You can use htmlspecialchars to avoid tags if you just want to make sure that no html is displayed in the comments - according to the Matchu example, less unintended effects will occur with it than with strip_tags.
For a word filter, depending on how you want to go, there are many examples on the Internet, from simple to. Here is the code from the example of Jake Olefsky (simple, linked earlier):
<?
function BadWordFilter(&$text, $replace)
{
$bads = array (
array("butt","b***"),
array("poop","p***"),
array("crap","c***")
);
if($replace==1) {
$remember = $text;
for($i=0;$i<sizeof($bads);$i++) {
$text = eregi_replace($bads[$i][0],$bads[$i][5],$text);
}
if($remember!=$text) return 1;
} else {
for($i=0;$i<sizeof($bads);$i++) {
if(eregi($bads[$i][0],$text)) return 1;
}
}
}
$any = BadWordFilter($wordsToFilter,1);
$any = BadWordFilter($wordsToFilter,0);
?>
Many other examples of this can be easily found on the Internet.
source
share