title: How to bypass the PHP strip_tags function
body: <p>Consider the following situation. A regular user posts a text-comment to a website. </p>
  
  <p>Then</p>
  
  <ol>
  <li>the text gets stored in a php variable.</li>
  <li>strip_tags is called with the variable as its argument.</li>
  <li>the comment is displayed, saved or whatever</li>
  </ol>
  
  <p>Like so</p>
  
  <pre><code>&lt;?php 
   $xss='" style="a:b;margin-top:-1000px;margin-left:-100px;width:4000px;height:4000px;display:block;" onmouseover=alert(1); a="';
   $xss=strip_tags($xss);
   print '&lt;input name="123" value="'.$xss.'"/&gt;';
  ?&gt;
  </code></pre>
  
  <p>And my exact question is: How do I change the <code>$xss</code> string so when </p>
  
  <p><code>print '&lt;a href="#"&gt;'.$xss.'&lt;/a&gt;';</code> is called instead of<br>
  <code>print '&lt;input name="123" value="'.$xss.'"/&gt;';</code> the page executes <code>alert(1)</code>  in some way?</p>