Only run HTML (PHP) -

i'm here question on project; try explain best possible:

i have text area in user can write whatever want. problem can try kind of malicious code (js xss, example) using function:

echo htmlspecialchars($topic->getmessage(), ent_quotes, 'utf-8');

i thought had solved problem, remembered user can type html, , allowed.

is there function made running html , others stay text?

htmlspecialchars ok not safe insert mysql.

for mysql it's better use prepared statements, such explained here: http://bobby-tables.com/php.html

for output in page (without inserting on database), htmlspecialchars enough... provided don't decode before printing.

like cbroe suggested, use http://htmlpurifier.org/ clean html , avoid garbage in database, still must use prepared statements.

also read: http://php.net/manual/en/pdo.prepared-statements.php

Ben