Entry

How can I strip / remove all HTML and PHP tags from a string?

Apr 13th, 2003 17:05
Mike Tripolox, Ken Roberts, Nathan Wallace, Matt Zandstra

Try using the strip tags function:

    http://www.php.net/manual/function.strip-tags.php3

If want to keep some tags, the second argument that you provide is a 
string of valid tags in the form "<a> <tr>", etc.

Also, you can keep the tags in a variable and use a variable 
for the 2nd argument instead.

For example, to keep the <a>nchor, <font>, <br> (break), <b> (bold) and 
<p> (paragraph) tags, you would call:

    strip_tags( $some_html_string, "<a> <font> <b> <br> <p>");

or optionally:

    $valid_tags = "<a> <font> <b> <br> <p>";
    strip_tags( $some_html_string, $valid_tags);

That's good. Here are another way: 

http://www.php.net/manual/en/function.htmlspecialchars.php

htmlspecialchars --  Convert special characters to HTML entities 

Description
string htmlspecialchars ( string string [, int quote_style [, string
charset]])
Certain characters have special significance in HTML, and should be
represented by HTML entities if they are to preserve their meanings.
This function returns a string with some of these conversions made; the
translations made are those most useful for everyday web programming. If
you require all HTML character entities to be translated, use
htmlentities() instead. 

This function is useful in preventing user-supplied text from containing
HTML markup, such as in a message board or guest book application. The
optional second argument, quote_style, tells the function what to do
with single and double quote characters. The default mode, ENT_COMPAT,
is the backwards compatible mode which only translates the double-quote
character and leaves the single-quote untranslated. If ENT_QUOTES is
set, both single and double quotes are translated and if ENT_NOQUOTES is
set neither single nor double quotes are translated. 

The translations performed are: 


'&' (ampersand) becomes '&amp;' 

'"' (double quote) becomes '&quot;' when ENT_NOQUOTES is not set. 

''' (single quote) becomes '&#039;' only when ENT_QUOTES is set. 

'<' (less than) becomes '&lt;' 

'>' (greater than) becomes '&gt;' 

Example 1. htmlspecialchars() example

$new = htmlspecialchars("<a href='test'>Test</a>", ENT_QUOTES);
 
 


Note that this function does not translate anything beyond what is
listed above. For full entity translation, see htmlentities(). Support
for the optional second argument was added in PHP 3.0.17 and PHP 4.0.3. 

The third argument defines character set used in conversion. The default
character set is ISO-8859-1. Support for this third argument was added
in PHP 4.1.0.