cross site scripting

[fernandodonster]

how we prevent cross site scripting with php?
eg<script>alert('Hello World!');</script>

[NogDog]

The simplest way is to not allow user inputs that contain HTML tags, such as via [man]strip_tags/man. If you need to allow some HTML tags but not others, then you can either use the optional allowed tags argument for strip_tags(), or perhaps implement some "bbcode" solution that only supports the tags types you want to allow.

[khaine]

Can also use htmlspecialchars to allow users to type what they like, and only get what you want them to have.