What characters to strip from messages?

Answer 1

This is where HTML Purifier comes in handy.

Answer 2

I would say that you don't have to strip any characters from your input, at least generally speaking.

Instead, you must escape your data :

• when sending it to your database
  • see mysql_real_escape_string, mysqli_real_escape_string, PDO::quote
  • or Prepared statements : MySQLi ; PDO
• when sending it to the HTML output
  • see htmlspecialchars

Still, if you allow users to input HTML, you should take a look at HTMLPurifier, to make sure they are not able to inject any malicious HTML code into your web-pages :

HTML Purifier is a standards-compliant HTML filter library written in PHP. HTML Purifier will not only remove all malicious code (better known as XSS) with a thoroughly audited, secure yet permissive whitelist, it will also make sure your documents are standards compliant

Answer 3

Instead of sanitizing your data just use Prepared Statements for database interaction. PDOs eliminate the need of hand santizing all of your input yourself.

PHP Manual