如何阻止用户将HTML代码放入文本输入中

Question

iv been building a website and while testing I noticed that if I put <em>bob</em>

or something similar in my text fields on my register/udate pages they are stored on the database as entered '<em>bob</em>' but when called back on to the website they display in italics

is there a way to block html code from my text inputs? or dose it only read as html when being echoed back on the page from the database? mostly just curious to know what's happening here? the name displaying in italics isn't a major issue but seems like something the user shouldn't be able to control?

p.s. i can provide code if needed but didn't think it would be much help in this question?

Answer 1

You can use strip_tags to remove all HTML tags from a string: http://php.net/manual/es/function.strip-tags.php

<?php
$text = '<p>Test paragraph.</p><!-- Comment --> <a href="#fragment">Other text</a>';
echo strip_tags($text); // Output: Test paragraph. Other text
echo "
";

// Allows <p> and <a>
echo strip_tags($text, '<p><a>'); // Output: <p>Test paragraph.</p> <a href="#fragment">Other text</a>
?>