Why not using strip_tags() to prevent xss attack instead of htmlspecialchars()?

PHP
1

If I need to display $_GET values in templates, why not using strip_tags() to prevent xss attack instead of htmlspecialchars()?

2

strip_tags() removes content, htmlspecialchars() makes the content save for insertion in HTML-context.

3

This topic was automatically closed 91 days after the last reply. New replies are no longer allowed.