kses v.s. strip_tags

Question

kses (http://sourceforge.net/projects/kses/) or just strip_tags, which to use?

Answer 1

Depends very much on your use-case. You can be sure that strip_tags() is much faster, since it is a builtin function that was written in c. kses on the other hand seems to provide more features. So if you don't need more than what strip_tags() does, just use the builtin function.

Answer 2

I had a quick look at the kses code. I noticed that:

• it relies on the ‘>’ character not being present in attribute values (which is legal)

• its ‘bad URL protocol’ handler won't filter out things it can't parse, like malformed character references and control characters.

I don't think I'd really trust this.

If you must allow (and filter) HTML, you could try the htmlpurifier. I can't vouch for its security either, but it is widely used.

HTML filtering using anything other than a full HTML parser is hard. If you can provide any alternative to allowing the user to enter HTML (eg. using a simplified textual markup language), do that instead.