title: Protect WYSIWYG input from XSS attacks in PHP?
body: <p>I have read in my places that to prevent XSS attacks, the best practice is to do first a <code>stripslashes</code> and then a <code>htmlspecialchars</code> on the user input. However, in some cases that is not possible, for example when allowing the user some basic markup with a WYSIWYG editor.</p>
  
  <p>Does PHP offer any methods for this, that allow a certain whitelist of basic tags (b, i, u, a, img, ...) but strips them of all their potentially dangerous arguments, as well as escaping all html special chars except for the <code>&lt;</code>,<code>&gt;</code> and <code>"</code> belonging to the set of whitelisted tags &amp; tag arguments? </p>
  
  <p>Or should I just forget about doing that and switch to a different approach like using BBcode for user input with markup?</p>