Strip <script> tags and everything in between with PHP?

Question

How would I go about removing script tags, and everything inside them using PHP?

Answer 1

$html = preg_replace("@<script[^>]*>.+</script[^>]*>@i", "", $html);

Answer 2

As David says, filtering only script tags is not enough if you're looking to sanitize incoming data. HTML Purifier promises to do the full package:

HTML Purifier is a standards-compliant HTML filter library written in PHP. HTML Purifier will not only remove all malicious code (better known as XSS) with a thoroughly audited, secure yet permissive whitelist, it will also make sure your documents are standards compliant, something only achievable with a comprehensive knowledge of W3C's specifications.

Answer 3

Go with HTML Purifier as Pekka suggested.

Never go with regex for that case

Here is a example, regexes filters broken, works on browsers (tested on firefox)

<script script=">>><script></script><script>//"  >
/**/
alert(1);
</script
>

Answer 4

You can do that with the function strip_tags

http://www.php.net/strip_tags

<?php
$text = '<p>Test paragraph.</p><!-- Comment --> <a href="#fragment">Other text</a>';
echo strip_tags($text);

// Allow <p> and <a>
echo strip_tags($text, '<p><a>');
?>