Hey, you PHP gurus: What do you guys use for purifying HTML output?

My need: I'm working on a small PHP/MySQL project for work. Most of the page output is my own HTML, but some of it is entered by users. I'm not a very proficient web programmer, but I figured that I should make sure that these parts of my pages don't output pr0n img tags or links to external sites.

I'd much rather do the filtering on the (HTML) output side than on the (user) input side. I've heard of HTML Purifier, but I didn't really want to try integrating a whole system at this point - just wanted to make sure a few lines of HTML output are okay.

Even though I'm not a PHP guru I would recomend Zend_Filter StripTags. You can specify, which html or php tags you want to keep and all others will be removed. See http://framework.zend.com/manual/en/....set.striptags

Hi -

1. As far as PHP security, your best bet is safe coding practices. There are lots of sites; there's lots of good information on this site alone:

http://www.tutorialized.com/tutorials/PHP/Security/1
<= You have to click two or three levels down to get to the actual tutorials ...
... but they're worth it!

2. HTML vulnerabilities are certainly one area worth protecting against. But SQL vulnerabilities (e.g. SQL injection) are equally worthy of your attention:
http://www.tutorialized.com/view/tut...-hackers/41498
<= You can find many, many other sites discussing SQL injection, and related issues

3. Finally, if you're new to SQL, I would encourage you to get this book:

SQL Queries for Mere Mortals, John L. Viescas; Michael J. Hernandez
<= This will pay for itself within hours! Satisfaction guaranteed!

'Hope that helps .. PSM