sanitizing html user inputs in php codeigniter

Question

I have a user form where users can post comment on articles. i need to allow strong, em and span tags for user inputs. I know this can be achieved through strip_tags function but i also want the other tags not to stripped but be changed using say htmlspecialchars function so that tags can be seen in the page. I hope it made sense.

Answer 1

Strip tags isn't safe. It'd allow a tag like <strong onmouseover="alert('xss');">mouse over this lol</strong> through. Use HTMLPurifier

Answer 2

I think what you are looking for is the prep_for_form validation rule found here. Additionally you probably want to use xss_clean.