Take the 2-minute tour ×
WordPress Development Stack Exchange is a question and answer site for WordPress developers and administrators. It's 100% free, no registration required.

What is the difference between strip_tags and wp_filter_nohtml_kses. I tried to figure wp_filter_nohtml_kses from the source but it looks like it does something a bit more complex than strip all html even though thats what the codex says. I think the kses functions are expensive so I wonder why not use strip_tags if all it does is strip the html.

share|improve this question

1 Answer 1

up vote 4 down vote accepted

Technical difference is kinda obvious. PHP one is single function, using logic in PHP code. WP one is one of family of functions, based on third party KSES library.

Is there practical difference between these two specific functions? I think the important point is that strip_tags() was made for utility, while KSES was made for security.

So, while results would likely be close in most cases, I would expect KSES implementation be slower and more thorough.


I have encountered comparison of HTML filters at HTML Purifier site, following is excerpt of strip_tags() and kses (original, non-WP version) summary (there is more there on both):

+------------+------------+---------+-------------+---------+------------+--------------------------+
|  Library   | Whitelist  | Removal | Well-formed | Nesting | Attributes | XSS safe | Standards safe |
+------------+------------+---------+-------------+---------+------------+----------+----------------+
| strip_tags | Yes (user) | Buggy   | No          | No      | No         | No       | No             |
| kses       | Yes (user) | Yes     | No          | No      | Partial    | Probably | No             |
+------------+------------+---------+-------------+---------+------------+----------+----------------+
share|improve this answer
2  
I see what you are saying about the kses functions being designed for security, but if strip_tags actually strips all the tags then do you mean that strip_tags might possibly miss some html tag? Or are we thinking that that evil code might somehow get around strip_tags. I dont really understand why I'd use wp_filter_nohtml_kses if it's expensive to run and strip_tags does the same thing? –  byronyasgur Mar 12 '12 at 13:53
2  
@byronyasgur I don't have any specific examples or reference right now, but my vague impression is that strip_tags() is indeed not absolutely reliable to remove all tags, especially on very malformed HTML. I might be completely mistaken on this, so I'd suggest to make question about how reliable it really is on Stack Overflow. –  Rarst Mar 12 '12 at 14:41

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.