Preventing XSS but still allowing some html in Php

Question

I want to block xss attacks but i still want to allow html tags like <b><u><i><img><a> and YouTube video players. I don't want to be open for XSS attacks tho. I am using php.

Answer 1

strip_tags($string, "<b> <u> <i> <img> <a>");

This will not prevent someone from using onmouseover etc. though - you have to strip out Javascript.

Answer 2

I recommend using htmlpurifier, it is the most secure tool to filter html.

I suggest you also to read this great analysis of HTML sanistisation tools for php.