I am creating a message board using php and mysql. I use a textbox form (like this one) and pass the input through the following function before inserting into the table. Am I leaving this wide open for any known exploits?
function strip_nasty_stuff(&$str) {
$str = strip_tags($str, '<b></b><i></i>');
$str = trim($str);
$str = nl2br($str);
if (strlen($str) > 10000) {
$str = substr($str,0,10000);
}
}
