Is there anyway to clear the html code via php which is stored in the database?

Question

Possible duplicate:
What is the best method for disinfecting user input using PHP?

I use TinyMCE to allow editing a small part of a web page.

This field is stored in the database.

Is there a regex that I can use to clear incoming HTML to avoid any kind of attack like XSS / NULL / DROP TABLES?

I did this on single-line text / numbers inputs, etc., but am not sure how to do this when getting an HTML string.

Answer 1

I would recommend playing with HTMLPurifier .

Answer 2

You can use PHP functions: striptags and htmlspecialchars :

http://php.net/manual/en/function.strip-tags.php

Answer 3

You can use this -

  function safe_sql($obj) { $obj = htmlspecialchars($obj); $obj = str_replace('"',""",$obj); $obj = str_replace("'","'",$obj); $obj = str_replace("`","`",$obj); $obj = mysql_real_escape_string($obj); return $obj; } 

I use it and it works fine. And you can also use this function to make it normal (after pulling data from the database) -

  function to_Normal($data) { $data = htmlspecialchars_decode($data); $data = str_replace(""",'"',$data); $data = str_replace("'","'",$data); $data = str_replace("`","`",$data); $data = nl2br($data); return $data; }