Question: Am currently working on an application that requires users to submit posts and comments which is displayed on the site. As we all know that user input can't be trusted so i used htmlspecialchars($string,ENT\_QUOTES) to process user's posts and comments. 

Now, i want some certain html tags ignored. such as `<b><br />` and a few more tags. How can i do it so that htmlspecialchars ignores some tags while it filters the others.

Answer: 
> Tired of using BBCode due to the current landscape of deficient or insecure HTML filters?

--> [HTML Purifier](http://htmlpurifier.org/)

> HTML Purifier is a standards-compliant HTML filter library written in PHP. HTML Purifier will not only remove all malicious code (better known as XSS) with a thoroughly audited, secure yet permissive whitelist, ...
This isn't as simple as you might thing because neither [`htmlspecialchars()`](http://de.php.net/manual/en/function.htmlspecialchars.php) nor [`htmlentities()`](http://de.php.net/manual/en/function.htmlentities.php) provides any options to ignore certain tags (both functions don't even know the meaning of the notion of *tags*).

You could use some other means to allow the users to format their posts, e.g. [BBCode](http://en.wikipedia.org/wiki/BBCode), [Textile](http://en.wikipedia.org/wiki/Textile_(markup_language)) or [Markdown](http://en.wikipedia.org/wiki/Markdown). There are PHP parsers available for all of them.

If you'll have to stick with html-tags you could resort to some preprocessing that reformats the allowed tags so that they will not be affected by [`htmlspecialchars()`](http://de.php.net/manual/en/function.htmlspecialchars.php). You can then postprocess the result to change back the format to normal HTML-tags. The following sample visualizes this process for a simple `<a>`-tag. Please be aware that processing HTML with regular expressions is error-prone and not always the way to go - I'll use it just for the sake of simplicity in this example.

```
$input = preg_replace('~<(/?\w+([^>]*?))>~', '|#$1#|', $input);
$input = htmlspecialchars($input);
$inoput = preg_replace('~|#(/?\w+(.*?))#|~', '<$1>', $input);

```

This is untested and will surely require a lot more work.