php - prevent xss but allow all html tags

Question

I am building a blog and currently im finishing the admin panel.

Since i will be mostly who will be managing it... i want to make sure that when i type

<ul>
   <li>test</li>
   <li>test</li>
</ul>

will show me the unordered list but also prevent XSS tags just in case...

how could i do that?

could a solution be creating functions and replace the tags of ul, ol, img etc...?

Answer 1

What you are looking for is an HTML sanitizer. These are very hard to write correctly, so you should look at an existing library. For PHP, have a look at HTML Purifier.

Proper XSS protection involves more than html sanitizing. The Open Web Application Security Project (OWASP) has put together a canonical guide to avoiding XSS attacks:

XSS (Cross Site Scripting) Prevention Cheat Sheet