Cleansing $_POST for XSS

[LazyManc]

Right, I've been given some code to maintain and some of the vulnerabilities are clearly obvious.

I'm just looking for a quick way to cleanse $_POST so it's safe to echo to the page...

foreach ($_POST as &$value) {
   $value = strip_tags($value);
}

Is that enough? I already have sql injection in place in the database scripts so no need to worry about that here.

* edit: I thought they'd fixed the php code background colour here?

 

[Moredhel]

If you want to preserve the actual content then use htmlspecialchars instead of strip_tags.