title: Prevent Javascript Injection in data attribute
body: <p>I have a script that pulls a text from an API and sets that as a tooltip in my html.</p>
  
  <pre><code>&lt;div class="item ttip" data-html="&lt;?php echo $obj-&gt;titleTag;?&gt;"&gt;...&lt;/div&gt;
  </code></pre>
  
  <p>The API allows html and javascript to be entered on their side for that field. </p>
  
  <p>I tried this <code>$obj-&gt;titleTag = htmlentities(strip_tags_content($this-&gt;channel-&gt;status)));</code></p>
  
  <p>I now had a user that entered the following (or similar, he is blocked now I cannot check it again):</p>
  
  <pre><code>\" &lt;img src="xx" onerror=window.location.replace(https://www.youtube.com/watch?v=IAISUDbjXj0)&gt;
  </code></pre>
  
  <p>which does not get caught by the above.
  I could <code>str_replace</code> the window.location stuff, but that seems dirty.
  What would be the right approach? I am reading a lot of "Whitelists" but I don't understand the concept for such a case.</p>
  
  <p>//EDIT strip_tags_content comes from here: <a href="https://php.net/strip_tags#86964" rel="nofollow">https://php.net/strip_tags#86964</a></p>