title: TextArea Data Sanitizing Before Storing In MySQL
body: <p>Here's the problem scenario.  I have a textbox in which users can input comments.  However, if they include HTML tags or <code>&lt;A HREF='javascript:window.alert("Example of a link that displays an alert box");'&gt; link &lt;/A&gt;</code>, and when the comments are outputted onto the page from the MySQL database, they actually execute.  I'm looking for a way to prevent that from happen and only allow a few HTML tags to be used (like bold, italics, underline).</p>
  
  <p>I'm using this function on my comments before sending the comments from the textarea to be stored on the mysql database:</p>
  
  <pre><code>function sanitize($data)
  {
  // remove whitespaces (not a must though)
  $data = trim($data); 
  
  // apply stripslashes if magic_quotes_gpc is enabled
  if(get_magic_quotes_gpc())
  {
  $data = stripslashes($data);
  }
  
  // a mySQL connection is required before using this function
  $data = mysql_real_escape_string($data);
  
  return $data;
  }
  </code></pre>