I have a PHP web applications. I do NOT want to allow users to post HTML to my site.
If I simply run strip_tags() on all data prior to saving into my database, will strip_tags() be enough to prevent XSS?
I ask because it's unclear to me from reading the documentation of strip_tags if XSS is prevented. There seems to be some bug with browser allowing <0/script> (yes, a zero) as valid HTML.
UPDATE
I realize that I can simply run htmlspecialchars on all outputted data; however, my thought is that - since I don't want to allow HTML in the first place, it's simply easier (and academically better) to clean my data once and for all, before saving in my database, then have to worry every time I output the data if the data is safe or not.
Answer
I strongly disagree it's "academically better".
It breaks user input (imagine how useless StackOverflow would be for this discussion if they "cleaned" posts from all tags).
Text inserted in HTML with only tags stripped will be invalid. HTML requires
&to be escaped as well.It's not even safe in HTML!
strip_tags()is not enough to protect values in attributes, e.g.,<input value="$foo">might be exploited with$foo=" onfocus="evil()(no<,>needed!)
So the correct solution is to escape data according to requirements of language you're generating. When you have plain text and you're generating HTML, you should convert text to HTML with htmlspecialchars() or such. When you're generating e-mail, you should convert text to quoted-printable format, and so on.