Strip off Tags from a Text String
For safety reasons you really should remove tags from the text that you users can input.
In PHP we have a nice little tool to strip off all HTML and PHP tags from any text. You can use it like in the example below, where the input from a textfield named 'form-subject' is read in a normal way with $_POST[''] and put in a variable named $subject. This is then parsed through the strip_tags and can then safely be written in to your database.
PHP
(Click the line to copy to clipboard. Notice that the code is in two blocks.)
As you see its just takes a single code to strip of the tags. This is built in to PHP, and its a useful code to use.
The example show the basic use of the strip_tags code.
<?php
$subject = strip_tags($_POST['form-subject']);
?>
This example;
<?php
$teststring = "<A HREF=''>Hello world</A><?php mysqli_query($con, $SQLstr); ?>";
$teststring = strip_tags($teststring);
echo $teststring;
?>
...will result in this output;
'Hello world'