检测HTML代码注入

Question

Using the php strip_tag function to prevent HTML injection into my database I was wondering if there's any way I can detect if it's been used, ie the following:

if (strip_tags has been used/had any effect on the code) { error; }

I want to output an error the user letting them know that HTML tags cannot be used before hand instead of going straight to the db insertion.

Answer 1

Simply compare the sanitized data to the original data, and add a warning to the user if they don't match:

$data = $_GET["field_name"];
$sanitized = strip_tags($data);
if ($sanitized != $data) {
    echo "HTML not allowed.";
    // or...
    // throw new Exception("HTML not allowed.");
}