Question: Am currently working on an application that requires users to submit posts and comments which is displayed on the site. As we all know that user input can't be trusted so i used htmlspecialchars($string,ENT\_QUOTES) to process user's posts and comments. 

Now, i want some certain html tags ignored. such as `<b><br />` and a few more tags. How can i do it so that htmlspecialchars ignores some tags while it filters the others.

Answer: 
It is **very, very difficult** to allow only some HTML tags without allowing any possibility of script injection or the like. 

I would actually recommend avoiding this and using something that generates HTML such as [this UBB code parser](http://www.phpclasses.org/browse/package/818.html) (or similar). Or even [Markdown](http://daringfireball.net/projects/markdown/) (with HTML option turned off).

That gives no scope for attackers to hit your site, which is very important if it is public-facing.

If you allow even some HTML through, chances are that a determined attacker will find a way round it.
You can replace the quoted string to re-insert the allowed tags. For `<b>` tags for example:

```
$string = str_replace(array('&lt;b&gt;', &lt;/&gt;), array('<b>', '</b>'), $string);

```

I would only allow very distinct, complete tags to be as secure as possible. I.e. Don't use regular expressions if you don't have to, it can lead to very nasty bugs.