Re: Preventing cross site scripting

[Matt Rohrer <matt () prognostikos com>]

On Thu, Jun 19, 2003 at 07:28:06PM +0100, Andrew Beverley wrote:
> I am currently writing a web application that, as a small part of it,
> needs to display an email message. Obviously the message is potentially
> in html format, which to display could be sent straight to the browser.

[...]

> Are there any functions available (for php) that will take a html page
> as input and strip out all nasty stuff? Does anyone have suggestions as
> to how to do this as easy as possible?

<http://www.mricon.com/html/phpfilter.html> is supposedly the
filtering code used by SquirrelMail. It seems to be fairly robust.

Matt