typing </table> etc ruins my forum

[Mr_Alien]

How can I stop users from typing html commands like </table> into my forum message fields?

I could use javascript to ensure no "<" or ">" characters are used, but then this restricts the genuine use of them.

Is it possilbe that I can just print out everything the user writes, including "</table>" JUST LIKE THIS FORUM DOES!! ?

Thanks

[Mr_Alien]

Oh I see, I need to use reg_replace to swap "<" for &lt; and ">" with &gt;

[Mr_Alien]

and incase the user wants to type &lt; I need to swap it for &*amp;lt; without the star, else it does wreck it.

[bobthedog]

Or you could always use [man]htmlentities/man or [man]htmlspecialchars/man which would do all html chars for you and can be done in one easy function call rather than messing around with regular expressions.

[Norman_Graham]

Yes, Mr Alien, you seriously want to protect your site with htmlspecialchars etc. Have a look also at stripslashes().

Norman

[immot]

I would use strip_tags() to do this. You can even allow some tags.

• immot