How to remove malicious HTML (XXS, etc.) from content materials?

Question

I have a content presentation form that contains several input fields, all of which are sent directly to the database when sending. When this content is requested, it is printed.

I realized that this is a security issue.

How can I crop only malicious HTML (XSS) while retaining formatting tags ( b, ietc.)?

Answer 1

@pst ... . , , , HTML Tidy ( Source Forge), , DOMDocument:: loadHTML .

HTML Tidy , . . (. BLOB , - , -).

.

Answer 2

htmlspecialchars , (, &lt;b&gt; <b>).

Answer 3

mysql_stripslashes(), htmlspecialchars() urldecode(), , , int typecast.

Answer 4

, "" html- - , <strong> <em>. , , , .

Answer 5

, ...

PHP , :

htmlspecialchars

Answer 6

.

, : , javascript, - , javascript ,

• , html

-, , . , <, > & <, > & .

, , , textarea

• , html, .

, , , db.

, , , , , ,

Separate the characters <and >before exiting or storing - this is not a good solution, in my opinion, since this is an unnecessary change to user input, but some people prefer it.