Search code examples
phphtmlperltagsstrip

How do I strip custom tags from text in a submitted html form using PHP/Perl?

I have a news submission form. I want it to be secure from XSS and the like by stripping all html tags. Then I will convert all other tags with this format

[tagname attributes][/closetagname]

To this

<tagname attributes></closetagname>

. The question is how do I do the conversion of the tags to this format.

Solution

  • You will not be secure from XSS just by "stripping all html tags" and "convert all other tags". Fighting XSS only works by whitelisting some known tags (and whitelist some known attributes) while blacklisting will always fail. Here is a more complete explanation.

    A good solution to clean HTML code in PHP is to use HTML Purifier.