> ## Content Index
> Fetch the complete content index at: https://securinglaravel.com/llms.txt
> Use this file to discover other available public pages before exploring further.

# Security Tip: strip_tags() Won't Save You from XSS!
- URL: https://securinglaravel.com/security-tip-strip_tags-wont-save-you-from-xss/
- Published: 2024-12-02T00:23:49.000Z
- Updated: 2024-12-02T00:27:48.000Z
- Description: [Tip #98] XSS doesn't just hide in <script> tags - it sneaks in through HTML attributes, links, and even inline styles! Don't rely on functions like strip_tags() to keep you safe...
- Author: Stephen Rees-Carter
- Tags: Security Tips, Audits Top 10, XSS

💡

**We're digging into the weaknesses identified in the updated* [**Laravel Security Audits Top 10*](https://securinglaravel.com/in-depth-laravel-security-audits-top-10-2024/) *list for 2024\. This week we're looking at* ***#1 Cross-Site Scripting (XSS)!** [**You can find all of the articles here.*](https://securinglaravel.com/tag/audits-top-10/)

Last we we talked about [Being Intentional with Your Outputs](https://securinglaravel.com/security-tip-be-intentional-with-your-outputs/) to avoid [Cross-Site Scripting (XSS)](https://securinglaravel.com/tag/xss/) sneaking their way into your applications. This was also something I spent some time talking about on in my recent [Laracon AU talk](https://laracon.au/talks/stephen-rees-carter?ref=securinglaravel.com).

In response to this security tip, I had a great email from [Christian Taylor](https://bsky.app/profile/imacrayon.com?ref=securinglaravel.com) who shared an XSS mistake he made a few years ago:

> Years ago I built an app that displayed WYSIWYG content submitted by users. I knew the input couldn’t be escaped because it required HTML, however I thought I could safely sanitize the input using a PHP function like this:  
>  
> `{!! strip_tags($wysiwyg_content, '<p><a><h1><ul><ol><li><img>’) !!}`  
>  
> What I later realized is that allowing the `<img>` tag meant users could input something bad like: `<img src=“x” onerror=“alert('pwnd')">` because I hadn’t considered that HTML attributes could also be dangerous.

The `strip_tags()` function is one of those PHP staples that's been around for ever. It does a great job of removing HTML tags from strings, leaving the ones you tell it to ignore, but in terms of security - it has a massive caveat... as Christian discovered.

Let's look at a quick example to demonstrate the issue:

```php
> $text = "You <b>cannot</b> pass! <img src=x onerror=alert(1)>";

> strip_tags($text);
= "You cannot pass! "

> strip_tags($text, "<img><b>");
= "You <b>cannot</b> pass! <img src=x onerror=alert(1)>"
```

A lot of folks forget that HTML supports Javascript through more than just the `<script>` tags. It's also executed through event attributes like `onclick` and `onerror`, in link `href` attributes with the `javascript:` protocol, and even inline styles!

XSS is sneaky and likes to pop up in all sorts of unexpected places, so be intentional with your outputs and make sure the tools you're using are right for the job.

In the case of `strip_tags()`, we looked at different ways it can be used back in [Is strip\_tags() Secure?](https://securinglaravel.com/security-tip-is-strip%5Ftags-secure/), and you should really consider [escaping](https://securinglaravel.com/tag/escaping/) and/or [sanitising your output](https://securinglaravel.com/security-tip-avoiding-xss-with-htmlstring/) with more robust tools than blindly using `strip_tags()`.

---

***If you found this security tip useful,*** [***subscribe***](#/portal/signup) ***to get weekly*** [***Security Tips***](https://securinglaravel.com/tag/tips/) **straight to your inbox.* Upgrade to a* [*premium subscription*](#/portal/signup) *for exclusive monthly* [*In Depth articles*](https://securinglaravel.com/tag/in-depth/)*, or drop a coin in the* [*tip jar*](#/portal/support) *to show your support.*

*Looking for a* [*Laravel Security Audit / Penetration Test*](https://stephenreescarter.net/laravel-security-audits-and-pentesting/?utm%5Fsource=securinglaravel.com)*, or a budget-friendly* [*Security Review*](https://stephenreescarter.net/laravel-security-reviews/?utm%5Fsource=securinglaravel.com)*? Feel free to reach out! You can also connect with me on* [*Bluesky*](https://bsky.app/profile/valorin.bsky.social?ref=securinglaravel.com)*, or* [*other socials*](https://pinkary.com/@valorin?ref=securinglaravel.com)*. And don’t miss* [*Practical Laravel Security*](https://practicallaravelsecurity.com/?utm%5Fsource=securinglaravel.com)*, my interactive course designed to boost your Laravel security skills.*