打印数据库存储wysiwyg html内容的安全方法

Question

I've built a blog CMS in PHP for my company's website. When one of our staff members writes a blog article in the admin area, it saves raw HTML to the MySQL database.

Example:

<p>Some example text written by my staff stored in the database</p>

On the page where I print the article to screen, in PHP, what is the safest method to print the HTML that would help prevent XSS or other nasties? Obviously, I still need the HTML tags for it to display in the same way the user wrote it.

I did try htmlspecialchars() but that printed the tags instead of using them.

Answer 1

你可以使用这个库： http ： //htmlpurifier.org/