Does strip_tags() protect against XSS?

[3raser]

I was reading the documentary for strip_tags() and it mentioned nothing about removing JavaScript tags (which I'm assuming is HTML since it's in the form of it - e.g: <script></script>). I just want to be assured that it does protect against XSS. Do you have any better recommendations?

 

Thanks.

[Psycho]

Did you try it? Here's a simple test.

$input = "This is input with <script type=\"javascript\"> alert('JavaScript'); </script> code.";

echo strip_tags($input);

 

And, a simple Google search for "PHP prevent XSS attacks" yielded plenty of good resources.

[requinix]

It should prevent many forms, but there are some it won't. It depends where you output the strings.

 

Pretty much all you need is htmlentities() or htmlspecialchars().