Still celebrating National IT Professionals Day with 3 months of free Premium Membership. Use Code ITDAY17

x
?
Solved

striptags vs. htmlentities

Posted on 2010-11-29
9
Medium Priority
?
938 Views
Last Modified: 2013-12-12
I am having trouble understanding why I would need striptags if I already use htmlenties.

Doesn't htmlentities render tags such as script, php, html etc. harmless?

What additional benefit would strip tags provide?

Thanks.
0
Comment
Question by:kadin
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 4
  • 3
  • 2
9 Comments
 
LVL 7

Accepted Solution

by:
lexlythius earned 500 total points
ID: 34236680
They serve different purposes.

htmlentities encode XML/HTML metacharacters such as <, >, &, etc so they can be safely included inside, say, a <TEXTAREA></TEXTAREA> element.

strip_tags is better used when you want to store text that will be rendered:
in plain-text context, and the HTML tags will clutter the output with garbage, or
in HTML context, but you want to prevent that stored text will be rendered as HTML, tipically to prevent final users from posting HTML and scripts on a web page

Anyway, keep in mind that strip_tags can be easily fooled.
0
 
LVL 7

Expert Comment

by:lexlythius
ID: 34236684
Forgot to state that strip_tags deletes the HTML tags as well as any text within them
0
 
LVL 18

Expert Comment

by:Sudaraka Wijesinghe
ID: 34236688
striptags only remove the HTML tags, even after you remove the tags, you might end up with text containing symbols that could mess up the HTML code like < or > in a sentence. Also if you have unicode characters or some thing outside the standard printable ASCII range, you will need to use htmlenties.
0
Independent Software Vendors: We Want Your Opinion

We value your feedback.

Take our survey and automatically be enter to win anyone of the following:
Yeti Cooler, Amazon eGift Card, and Movie eGift Card!

 

Author Comment

by:kadin
ID: 34236758
Thanks for your response. I am still a little foggy on how I should go about this.

I am receiving user input such as a paragraph in a textarea, inputting it into a database and displaying it back on a web page.

If strip_tags can be easily fooled, maybe I should forget about that function.

Does htmlentities stop javascript, php or any kind of xss?

I am using pdo and prepared statements.
0
 
LVL 18

Expert Comment

by:Sudaraka Wijesinghe
ID: 34236807
If you are getting the HTML from user and displaying it on the page, it's best to strip out any javascript tags using regular expression. Something like /<script[^>]*>(.*)</script>/i maybe? (not tested)

If you want to display the content with the formatting user entered, you should not use htmlentities.
0
 

Author Comment

by:kadin
ID: 34236836
I hope I am not causing confusion.

I am just trying to receive text from the user, not html. If the user inputs html such as <script>, I thought htmlentities would change < and > to entities, thus rendering a script tag useless.

If that is so, then I would not need a regex like you described above correct?
0
 
LVL 18

Assisted Solution

by:Sudaraka Wijesinghe
Sudaraka Wijesinghe earned 500 total points
ID: 34236874
Yes, htmlentities will make any script tags display as text, so any code will no execute with in them.

But it is safer to just filter out any javascript codes that user might enter. For example let's say one day you desided to transfer that content using AJAX or some method like that. Then if the correct encoding was not used there is a chance that javascript code might execute.
0
 

Author Comment

by:kadin
ID: 34236899
Thanks so much for your help. I think I am starting to understand this a little better.
0
 
LVL 18

Expert Comment

by:Sudaraka Wijesinghe
ID: 34236935
Glad to help. Thanks for the points.
0

Featured Post

Industry Leaders: We Want Your Opinion!

We value your feedback.

Take our survey and automatically be enter to win anyone of the following:
Yeti Cooler, Amazon eGift Card, and Movie eGift Card!

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Things That Drive Us Nuts Have you noticed the use of the reCaptcha feature at EE and other web sites?  It wants you to read and retype something that looks like this. Insanity!  It's not EE's fault - that's just the way reCaptcha works.  But it i…
Many old projects have bad code, but the budget doesn't exist to rewrite the codebase. You can update this code to be safer by introducing contemporary input validation, sanitation, and safer database queries.
Learn how to match and substitute tagged data using PHP regular expressions. Demonstrated on Windows 7, but also applies to other operating systems. Demonstrated technique applies to PHP (all versions) and Firefox, but very similar techniques will w…
The viewer will learn how to dynamically set the form action using jQuery.

670 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question