Prevent html insertion in text php

Question

I have an issue when i enter text i can enter html with the text.For example "I am entering text ". Now this link shows up as a link when the form is submitted. Any ideas on how to prevent this?

I am entering text <a href="xyz.com">Go to my site </a>. This is the input so when i output the data it comes out as I am entering text **Go to my site** with the hyperlink.

please elaborate with code examples – Doug Molineux Mar 04 '11 at 19:00 — Doug Molineux, Mar 04 '11 at 19:00
Are you going to show us some code? – Prisoner Mar 04 '11 at 19:00 — Prisoner, Mar 04 '11 at 19:00

score 6 · Answer 1 · edited May 23 '17 at 11:45

6

Put the string in htmlspecialchars() or strip_tags().

And, since I feel cleaning strings for other purposes will be the next question thrown out, I should bring up this: The ultimate clean/secure function

edited May 23 '17 at 11:45

Community

1
1

answered Mar 04 '11 at 19:00

Guttsy

2,130
1
18
29

score 2 · Answer 2 · answered Mar 04 '11 at 19:00

2

You aren't going to easily be able to prevent a user from entering tags without javascript, but you can use

 strip_tags()

on the backend to remove them.

 htmlspecialchars()

will not remove these tags, it will just encode the special characters.

answered Mar 04 '11 at 19:00

Brandon Frohbieter

17,563
3
40
62

score 0 · Answer 3 · answered Mar 04 '11 at 19:01

0

Normally, you do not want to prevent this. You want to make sure it doesn't output HTML when you print it.

The way to do that is like so:

echo $_GET['text']; // this prints HTML links etc
echo htmlspecialchars($_GET['text']); // this does not

answered Mar 04 '11 at 19:01

Jon

428,835
81
738
806

score 0 · Answer 4 · answered Mar 04 '11 at 19:02

0

If I understood correctly, you want to prevent injecting HTML code. Use htmlspecialchars().

echo htmlspecialchars($_POST['myform']);

answered Mar 04 '11 at 19:02

alexia

14,440
8
42
52

score 0 · Answer 5 · answered Mar 04 '11 at 19:03

0

Sanitize your input data before displaying it. This is well knows as a Cross Site Scripting (XSS) attack. You can use htmlspecialchars() or string_tags() to clean the data.

answered Mar 04 '11 at 19:03

Stephen P

14,422
2
43
67

Prevent html insertion in text php

5 Answers5