Welcome to the Cookbook

loading...

4.2.2 html

There is no translation yet for this section. Please help out and translate this.. More information about translations

html(string $string, boolean $remove = false)

This method prepares user-submitted data for display inside HTML. This is especially useful if you don't want users to be able to break your layouts or insert images or scripts inside of your HTML pages. If the $remove option is set to true, HTML content detected is removed rather than rendered as HTML entities.

$badString = '<font size="99" color="#FF0000">HEY</font><script>...</script>';
echo Sanitize::html($badString);
// output: &lt;font size=&quot;99&quot; color=&quot;#FF0000&quot;&gt;HEY&lt;/font&gt;&lt;script&gt;...&lt;/script&gt;
echo Sanitize::html($badString, true);
// output: HEY...
  1. $badString = '<font size="99" color="#FF0000">HEY</font><script>...</script>';
  2. echo Sanitize::html($badString);
  3. // output: &lt;font size=&quot;99&quot; color=&quot;#FF0000&quot;&gt;HEY&lt;/font&gt;&lt;script&gt;...&lt;/script&gt;
  4. echo Sanitize::html($badString, true);
  5. // output: HEY...
« paranoid | escape »