Database Administrators Stack Exchange is a question and answer site for database professionals who wish to improve their database skills and learn from others in the community. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Is there a way to sanitize database input (say, for a comment form), which also allows for the end user to use basic HTML styling markup? As in, if a user wraps their text in <i>/<em> or <strong>/<bold>, the text gets styled, all while preventing users from entering malicious PHP and SQL commands?

share|improve this question
First you have to decide what tags you will allow. Then you can strip all others (including <?php). To prevent SQL injection, use prepared statements (the details depend on what DB abstraction layer do you use). – dezso Oct 31 '12 at 14:50

There have been a few great discussions of this at Stack Overflow. This one covers methods and processes, but don't try to create a catch-all function as a replacement for understanding your data flows.

For your particular problem, it looks like HTML Purifier might be a good fit. That way, you could whitelist very specific HTML functionality (e.g., strong, ol, em) to prevent XSS. In addition, you can parameterize your queries (check out Bobby Tables for PHP specifics) to prevent SQL injection.

I wouldn't think of these two as one process, though, because they're really useful at different points in your application lifecycle: parameterizing your SQL queries is important when you're about to make a SQL call, but XSS protection is important when displaying the saved data in a Javascript-equipped browser (as opposed to saving text to the database).

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.