Strip <script> tags and everything in between with PHP?

Question

How would I go about removing script tags, and everything inside them using PHP?

Answer 1

As David says, filtering only script tags is not enough if you're looking to sanitize incoming data. HTML Purifier promises to do the full package:

HTML Purifier is a standards-compliant HTML filter library written in PHP. HTML Purifier will not only remove all malicious code (better known as XSS) with a thoroughly audited, secure yet permissive whitelist, it will also make sure your documents are standards compliant, something only achievable with a comprehensive knowledge of W3C's specifications.

Answer 2

Go with HTML Purifier as Pekka suggested.

Never go with regex for that case

Here is a example, regexes filters broken, works on browsers (tested on firefox)

<script script=">>><script></script><script>//"  >
/**/
alert(1);
</script
>

Answer 3

I use this:

$tag_para_remover_codigo_fonte_url_dentro_buscador = array("head","script","style","object","embed","applet","noscript","noframes","noembed");

for ($i=0;$i<count($tag_para_remover_codigo_fonte_url_dentro_buscador);$i++) {

    $codigo_fonte_url_dentro_buscador = preg_replace("/< *" . $tag_para_remover_codigo_fonte_url_dentro_buscador[$i] . "[^>]*>(.*?)<\/" . $tag_para_remover_codigo_fonte_url_dentro_buscador[$i] . " *>/i"," ",$codigo_fonte_url_dentro_buscador);

}

$codigo_fonte_url_dentro_buscador = html_entity_decode(strip_tags($codigo_fonte_url_dentro_buscador));