stopping html in forms

[weddingm]

Can anyone offer suggestions on how to stop html being carried over in forms in inputs and text areas? I am affrain of people adding outside links and more.

Thanks,
Matt

[willybfriendly]

Have you tried strip_tags() [us.php.net]

[weddingm]

I read that for security purposes, webmasters should stop html being entered into databases. Do you have a suggestion with posting the from info into a db and then printing the data?

[willybfriendly]

Use strip_tags BEFORE putting it into the DB. Stripping tags is just one small part of cleaning/filtering user supplied data. There are several good threads [google.com] about this in these forums.

[coopster]

Many content management systems (CMS) allow rich text editing (RTE) where a user may enter and submit html content. First, you have to know your potential user and whether or not you want to allow HTML to be entered and stored for display on your site. Next, you decide to what level. Should I allow ALL html? Just bold, italics, and the like? The function mentioned helps you on the server side to do the cleanup you desire.

Advice: decide on the potential user first. If it is a public blog, allow maybe just some minimum markup. Allow it in the client code (JavaScript) and then be certain to scrub it on the server by stripping undesired tags.

[weddingm]

Right now I use the code:

$value=mysql_real_escape_string(stripslashes(ucwords(strtolower($_POST["Value"])))); 

but I want to add the strip_tags(). Do I just add on the end or do you have a better suggestion?

[weddingm]

Is

$value=strip_tage(mysql_real_escape_string(stripslashes(ucwords(strtolower($_POST["Value"])))));

a valid code?

[weddingm]

s/b strip_tags