problem with strip_tags

[kfir_dnd]

Hello,
I've wrote the following code to try and remove any tag that isnt in the tag list out of the input

$content= $_POST['msg'];
$content= html_entity_decode($content);
$tags    = "<p><h1><font><ol><ul><li><hr>"
        ."<blockquote><a><img><embed><strong>"
        ."<em><u><strike><sup><sub>";
$content= strip_tags($content,$tags);  

And still some users mange to insert tags that aren't in the tag list...
What can I do to stop this?

Thanks in advance,
Kfir

P.S
The php version on my server is 4.4.7. magic_quotes_gpc is enabled.

[PartDigital]

why not store the tags into an array

$tags = array("ul", "ol", "li", "p", "blockquote", "img", "a"); 

then in your function loop through them and use str_replace.

function strip_tags($string, $tagArray)
{
    //looping through each tag. ex: ul
    for($i=0; $i<count($tagArray); $i++)
    {
       //storing the tag. ex: ul
       $currentTag = $tagArray[$i]; 

    if(substr_count($string, $currentTag)>0) 
    {
          //saving the open and close tags. ex: <ul></ul>
          $openAndCloseTags = array("<".$currentTag.">", "</".$currentTag.">"); 

         //replacing all occurances of the tags with "". ex: <ul> becomes "" 
         $string =  str_replace($openAndCloseTags, "", $string);
    }
}

}

note: the function above merely removes the tags themselves, it doesn't remove the content between them.

so

<ul>
   <li>Content</li>
</ul>

becomes

Content

it will take more work to remove the content itself.

In light of this why not simply make it validate. For instance if it finds it in the function just alert them that they can't paste tags.

function validate_tags($string, $tagArray)
{
    //looping through each tag. ex: ul
    for($i=0; $i<count($tagArray); $i++)
    {
       //storing the tag. ex: ul
       $currentTag = $tagArray[$i]; 

   if(substr_count($string, $currentTag)>0) 
    {
            //telling them that they can't post any tags in their message. 
            print "You can't have any tags!";  
    }
}

}

[bradgrafelman]

Well, the first thing I would suggest is to upgrade your old, unsupported version of PHP and don't re-enable magic_quotes_gpc when you do.

After that... can you show us some example data that got through the strip_tag() filter?