title: php htmlspecialchars and jquery .text()
body: <p>I ran into an issue recently. I have a system where users can post stuff. One of the fields is the <strong>title</strong> field. So to save user input safely I use htmlspecialchars on the user submitted title and send it to a function that then saves to the database (after using mysql_real_escape)</p>
  
  <p>Now on the client's side I use json get to fetch this title</p>
  
  <pre><code>$.getJSON("PHPFILE", function(json) {
     // let's say json.title is the title we need so...
     var title = json.title;
  }
  </code></pre>
  
  <p>Now the thing is this user given title value can contain anything, even html tags (for reference let's say it now contains</p>
  
  <pre><code>&amp;lt;script&amp;gt;alert(&amp;#039;&amp;#039;);&amp;lt;/script&amp;gt;Some Text!
  </code></pre>
  
  <p>so since I use jquery I thought of clearing those using the .text() function</p>
  
  <pre><code>var cleanTitle = $(title).text();
  alert(cleanTitle);
  </code></pre>
  
  <p>However this immediately throws an error. In chrome it says</p>
  
  <pre><code>Uncaught Error: Syntax error, unrecognized expression ...
  </code></pre>
  
  <p>So I verified if this <strong>title</strong> variable is a string. And it is indeed a string. (Btw for some reason if this variable contains only numbers there is no error)</p>
  
  <p>Using the following however gives me the text but the tags aren't removed</p>
  
  <pre><code>var cleanTitle = $.parseHTML(title);
  cleanTitle = $(cleanTitle).text();
  alert(cleanTitle);
  </code></pre>
  
  <p>This outputs</p>
  
  <pre><code>&lt;script&gt;alert('')&lt;/script&gt;Some Text!
  </code></pre>
  
  <p>How can I remove all html tags? Any suggestions? I am planning to use this title text to set Browser title. Thanks.</p>