title: Is strip_tags() vulnerable to scripting attacks?
body: <p>Is there a known XSS or other attack that makes it past a</p>
  <pre><code>$content = &quot;some HTML code&quot;;
  $content = strip_tags($content);
  
  echo $content;
  </code></pre>
  <p>?</p>
  <p>The <a href="http://php.net/strip_tags" rel="noreferrer">manual</a> has a warning:</p>
  <blockquote>
  <p>This function does not modify any attributes on the tags that you allow using allowable_tags, including the style and onmouseover attributes that a mischievous user may abuse when posting text that will be shown to other users.</p>
  </blockquote>
  <p>but that is related to using the <code>allowable_tags</code> parameter only.</p>
  <p><strong>With no allowed tags set</strong>, is <code>strip_tags()</code> vulnerable to any attack?</p>
  <p><a href="http://shiflett.org/articles/foiling-cross-site-attacks" rel="noreferrer">Chris Shiflett</a> seems to say it's safe:</p>
  <blockquote>
  <p>Use Mature Solutions</p>
  <p>When possible, use mature, existing solutions instead of trying to create your own. Functions like strip_tags() and htmlentities() are good choices.</p>
  </blockquote>
  <p>is this correct? Please if possible, quote sources.</p>
  <p>I know about HTML purifier, htmlspecialchars() etc.- I am <strong>not</strong> looking for the best method to sanitize HTML. I just want to know about this specific issue. This is a theoretical question that came up <a href="https://stackoverflow.com/questions/5788314">here</a>.</p>
  <p>Reference: <a href="http://lxr.php.net/opengrok/xref/PHP_5_3/ext/standard/string.c#php_strip_tags_ex" rel="noreferrer"><code>strip_tags()</code> implementation in the PHP source code</a></p>