I am creating a function for sanitising user inputs and user inputted data outputs.
Please offer advise on any improvements which could be made:
function cleanse($input) {
$search = array(
'@<script[^>]*?>.*?</script>@si', // Strip out javascript
'@<[\/\!]*?[^<>]*?>@si', // Strip out HTML tags
'@<style[^>]*?>.*?</style>@siU', // Strip style tags properly
'@<![\s\S]*?--[ \t\n\r]*>@' // Strip multi-line comments
);
$output = preg_replace($search, '', $input);
return $output;
}
function sanitise($input) {
if (is_array($input)) {
foreach($input as $var=>$val) {
$output[$var] = sanitize($val);
}
} else {
$input = cleanse($input);
$output = htmlspecialchars($input, ENT_QUOTES,'UTF-8',false);
}
return $output;
}
