title: How do I integrate HTML Purifier to filter user-submitted data?
body: <p>I have this script that collects data from users and I want to check their data for malicious code (such as XSS and SQL injections) by using <a href="http://htmlpurifier.org/" rel="nofollow noreferrer">HTML Purifier</a>, but how do I add it to my PHP form submission script?</p>
  
  <p>Here is my HTML Purifier code:</p>
  
  <pre><code> require_once '../../htmlpurifier/library/HTMLPurifier.auto.php';
  
   $config = HTMLPurifier_Config::createDefault();
   $config-&gt;set('Core.Encoding', 'UTF-8'); // replace with your encoding
   $config-&gt;set('HTML.Doctype', 'XHTML 1.0 Strict'); // replace with your doctype
   $purifier = new HTMLPurifier($config); 
  
   $clean_html = $purifier-&gt;purify($dirty_html);
  </code></pre>
  
  <p>Here is my PHP form submission code:</p>
  
  <pre><code>if (isset($_POST['submitted'])) { // Handle the form.
  
      $mysqli = mysqli_connect("localhost", "root", "", "sitename");
      $dbc = mysqli_query($mysqli,"SELECT users.*, profile.*
                                   FROM users 
                                   INNER JOIN contact_info ON contact_info.user_id = users.user_id 
                                   WHERE users.user_id=3");
  
      $about_me = mysqli_real_escape_string($mysqli, $_POST['about_me']);
      $interests = mysqli_real_escape_string($mysqli, $_POST['interests']);
  
  
  
  if (mysqli_num_rows($dbc) == 0) {
          $mysqli = mysqli_connect("localhost", "root", "", "sitename");
          $dbc = mysqli_query($mysqli,"INSERT INTO profile (user_id, about_me, interests) 
                                       VALUES ('$user_id', '$about_me', '$interests')");
  }
  
  
  
  if ($dbc == TRUE) {
          $dbc = mysqli_query($mysqli,"UPDATE profile 
                                       SET about_me = '$about_me', interests = '$interests' 
                                       WHERE user_id = '$user_id'");
  
          echo '&lt;p class="changes-saved"&gt;Your changes have been saved!&lt;/p&gt;';
  }
  
  
  if (!$dbc) {
          // There was an error...do something about it here...
          print mysqli_error($mysqli);
          return;
  }
  
  }
  </code></pre>