What is strip_tags in php

roger dot keulen at vaimo dot com ¶

3 years ago

https://bugs.php.net/bug.php?id=78346

After upgrading from v7.3.3 to v7.3.7 it appears nested "php tags" inside a string are no longer being stripped correctly by strip_tags().

This is still working in v7.3.3, v7.2 & v7.1. I've added a simple test below.

Test script:
---------------
$str = '\' ?>2';
var_dump(strip_tags($str));Expected result:
----------------
string(1) "2"Actual result:
--------------
string(5) "' ?>2"

CEO at CarPool2Camp dot org ¶

13 years ago

Note the different outputs from different versions of the same tag:

// striptags.php
$data = '
Each
New
Line';
$new  = strip_tags($data, '
');
var_dump($new);  // OUTPUTS string(21) "
EachNew
Line" php // striptags.php
$data = '
Each
New
Line';
$new  = strip_tags($data, '
');
var_dump($new); // OUTPUTS string(16) "Each
NewLine" php // striptags.php
$data = '
Each
New
Line';
$new  = strip_tags($data, '
');
var_dump($new); // OUTPUTS string(11) "EachNewLine"
?>

Trititaty ¶

6 years ago

Features:
* allowable tags (as in strip_tags),
* optional stripping attributes of the allowable tags,
* optional comment preserving,
* deleting broken and unclosed tags and comments,
* optional callback function call for every piece processed allowing for flexible replacements.

function better_strip_tags( $str, $allowable_tags = '', $strip_attrs = false, $preserve_comments = false, callable $callback = null ) {
  $allowable_tags = array_map( 'strtolower', array_filter( // lowercase
      preg_split( '/(?:>|^)\\s*(?:<|$)/', $allowable_tags, -1, PREG_SPLIT_NO_EMPTY ), // get tag names
      function( $tag ) { return preg_match( '/^[a-z][a-z0-9_]*$/i', $tag ); } // filter broken
  ) );
  $comments_and_stuff = preg_split( '/(|$))/', $str, -1, PREG_SPLIT_DELIM_CAPTURE );
  foreach ( $comments_and_stuff as $i => $comment_or_stuff ) {
    if ( $i % 2 ) { // html comment
      if ( !( $preserve_comments && preg_match( '//', $comment_or_stuff ) ) ) {
        $comments_and_stuff[$i] = '';
      }
    } else { // stuff between comments
      $tags_and_text = preg_split( "/(<(?:[^>\"']++|\"[^\"]*+(?:\"|$)|'[^']*+(?:'|$))*(?:>|$))/", $comment_or_stuff, -1, PREG_SPLIT_DELIM_CAPTURE );
      foreach ( $tags_and_text as $j => $tag_or_text ) {
        $is_broken = false;
        $is_allowable = true;
        $result = $tag_or_text;
        if ( $j % 2 ) { // tag
          if ( preg_match( "%^(\"'/]++|/+?|\"[^\"]*\"|'[^']*')*?(/?>)%i", $tag_or_text, $matches ) ) {
            $tag = strtolower( $matches[2] );
            if ( in_array( $tag, $allowable_tags ) ) {
              if ( $strip_attrs ) {
                $opening = $matches[1];
                $closing = ( $opening === ') ? '>' : $closing;
                $result = $opening . $tag . $closing;
              }
            } else {
              $is_allowable = false;
              $result = '';
            }
          } else {
            $is_broken = true;
            $result = '';
          }
        } else { // text
          $tag = false;
        }
        if ( !$is_broken && isset( $callback ) ) {
          // allow result modification
          call_user_func_array( $callback, array( &$result, $tag_or_text, $tag, $is_allowable ) );
        }
        $tags_and_text[$j] = $result;
      }
      $comments_and_stuff[$i] = implode( '', $tags_and_text );
    }
  }
  $str = implode( '', $comments_and_stuff );
  return $str;
}
?>

Callback arguments:
* &$result: contains text to be placed insted of original piece (e.g. empty string for forbidden tags), it can be changed;
* $tag_or_text: original piece of text or a tag (see below);
* $tag: false for text between tags, lowercase tag name for tags;
* $is_allowable: boolean telling if a tag isn't allowed (to avoid double checking), always true for text between tags
Callback function isn't called for comments and broken tags.

Caution: the function doesn't fully validate tags (the more so HTML itself), it just force strips those obviously broken (in addition to stripping forbidden tags). If you want to get valid tags then use strip_attrs option, though it doesn't guarantee tags are balanced or used in the appropriate context. For complex logic consider using DOM parser.

Anonymous ¶

5 years ago

Just bzplan's function with the option to choose what tags are replaced for

function rip_tags($string, $rep = ' ') {

        // ----- remove HTML TAGs -----
    $string = preg_replace ('/<[^>]*>/', $rep, $string);

        // ----- remove control characters -----
    $string = str_replace("\r", '', $string);    // --- replace with empty space
    $string = str_replace("\n", $rep, $string);   // --- replace with space
    $string = str_replace("\t", $rep, $string);   // --- replace with space

        // ----- remove multiple spaces -----
    $string = trim(preg_replace('/ {2,}/', $rep, $string));

        return $string;

}

D Mo ¶

4 years ago

When process a bulk of strings, the stripping of tags including their content on basis of regular expression is very slow. This function may help:

/**
* Removes passed tags with their content.
*
* @param array $tagsToRemove List of tags to remove
* @param $haystack String to cleanup
* @return string
*/
function removeTagsWithTheirContent(array $tagsToRemove, $haystack)
{
    $currTag = '';
    $currPos = false;$initSearch = function (&$currTag, &$currPos, $tagsToRemove, $haystack) {
        $currTag = '';
        $currPos = false;
        foreach ($tagsToRemove as $tag) {
            $tempPos = stripos($haystack, '<'.$tag);
            if ($tempPos !== false && ($currPos === false || $tempPos < $currPos)) {
                $currPos = $tempPos;
                $currTag = $tag;
            }
        }
    };$substri_count = function ($haystack, $needle, $offset, $length) {
        $haystack = strtolower($haystack);
        return substr_count($haystack, $needle, $offset, $length);
    };$initSearch($currTag, $currPos, $tagsToRemove, $haystack);
    while ($currPos !== false) {
        $minTagLength = strlen($currTag) + 2;
        $tempPos = $currPos + $minTagLength;
        $tagEndPos = stripos($haystack, '.$currTag.'>', $tempPos);
        // process nested tags
        if ($tagEndPos !== false) {
            $nestedCount = $substri_count($haystack, '<' . $currTag, $tempPos, $tagEndPos - $tempPos);

            for (

cesar at nixar dot org ¶

16 years ago

Here is a recursive function for strip_tags like the one showed in the stripslashes manual page.

function strip_tags_deep($value)
{
  return is_array($value) ?
    array_map('strip_tags_deep', $value) :
    strip_tags($value);
}// Example
$array = array('Foo', 'Bar', array('Foo', 'Bar'));
$array = strip_tags_deep($array);// Output
print_r($array);
?>

obeyer at popsugar dot com ¶

8 years ago

actually, for PHP 5.4.19, if you want to add line breaks
to allowable tags, you should use "
". Both
and
in allowable tags won't do anything, and line breaks will be stripped

fernando at zauber dot es ¶

7 years ago

As you probably know, the native function strip_tags don't work very well with malformed HTML when you use the allowed tags parameter.
This is a very simple but effective function to remove html tags. It takes a list (array) of allowed tags as second parameter:

function flame_strip_tags($html, $allowed_tags=array()) {
  $allowed_tags=array_map(strtolower,$allowed_tags);
  $rhtml=preg_replace_callback('/<\/?([^>\s]+)[^>]*>/i', function ($matches) use (&$allowed_tags) {       
    return in_array(strtolower($matches[1]),$allowed_tags)?$matches[0]:'';
  },$html);
  return $rhtml;
}
?>

The function works reasonably well with invalid/bad formatted HTML.

Use:

$allowed_tags=array("h2","a");
$html=<<

Example

Example

tom at cowin dot us ¶

12 years ago

With most web based user input of more than a line of text, it seems I get 90% 'paste from Word'. I've developed this fn over time to try to strip all of this cruft out. A few things I do here are application specific, but if it helps you - great, if you can improve on it or have a better way - please - post it...

function strip_word_html($text, $allowed_tags = '
')
    {
        mb_regex_encoding('UTF-8');
        //replace MS special characters first
        $search = array('/‘/u', '/’/u', '/“/u', '/”/u', '/—/u');
        $replace = array('\'', '\'', '"', '"', '-');
        $text = preg_replace($search, $replace, $text);
        //make sure _all_ html entities are converted to the plain ascii equivalents - it appears
        //in some MS headers, some html entities are encoded and some aren't
        $text = html_entity_decode($text, ENT_QUOTES, 'UTF-8');
        //try to strip out any C style comments first, since these, embedded in html comments, seem to
        //prevent strip_tags from removing html comments (MS Word introduced combination)
        if(mb_stripos($text, '/*') !== FALSE){
            $text = mb_eregi_replace('#/\*.*?\*/#s', '', $text, 'm');
        }
        //introduce a space into any arithmetic expressions that could be caught by strip_tags so that they won't be
        //'<1' becomes '< 1'(note: somewhat application specific)
        $text = preg_replace(array('/<([0-9]+)/'), array('< $1'), $text);
        $text = strip_tags($text, $allowed_tags);
        //eliminate extraneous whitespace from start and end of line, or anywhere there are two or more spaces, convert it to one
        $text = preg_replace(array('/^\s\s+/', '/\s\s+$/', '/\s\s+/u'), array('', '', ' '), $text);
        //strip out inline css and simplify style tags
        $search = array('#<(strong|b)[^>]*>(.*?)#isu', '#<(em|i)[^>]*>(.*?)#isu', '#]*>(.*?)#isu');
        $replace = array('$2', '$2', '$1');
        $text = preg_replace($search, $replace, $text);
        //on some of the ?newer MS Word exports, where you get conditionals of the form 'if gte mso 9', etc., it appears
        //that whatever is in one of the html comments prevents strip_tags from eradicating the html comment that contains
        //some MS Style Definitions - this last bit gets rid of any leftover comments */
        $num_matches = preg_match_all("/\