Jump to content

HTML sanitization

Edit links
From Wikipedia, the free encyclopedia
This is an old revision of this page, as edited by SierraAR (talk | contribs) at 15:25, 15 December 2012 (Added suggestion to use PHP htmlspecialchars()). The present address (URL) is a permanent link to this revision, which may differ significantly from the current revision.

HTML sanitization is the process of examining an HTML document and producing a new HTML document that preserves only whatever tags are designated "safe". HTML sanitization can be used to protect against cross-site scripting and SQL injection attacks by sanitizing any HTML code submitted by a user.

Tags often allowed are <b>, <i>, <u>, <em>, and <strong>.

In PHP this can be performed using the strip_tags() or htmlspecialchars() functions.[1][2]

In Java this can be achieved by using OWASP Java HTML Sanitizer Project [3]

References

  1. ^ http://www.php.net/strip_tags
  2. ^ http://php.net/manual/en/function.htmlspecialchars.php
  3. ^ https://www.owasp.org/index.php/OWASP_Java_HTML_Sanitizer_Project


Stub icon

This Web-software-related article is a stub. You can help Wikipedia by expanding it.

Retrieved from "https://en.wikipedia.org/w/index.php?title=HTML_sanitization&oldid=528166183"