Sign in Get started

PHP 8 reference · String Functions

PHP strip_tags() Function

Remove HTML and PHP tags from a string, keeping the text. You can allow some tags, but it's no XSS protection.

PHP 8 Since 4.0

Create a free account to save this page, take notes and track your progress. Sign in

Syntax

strip_tags(string $string, array|string|null $allowed_tags = null): string

Parameters

ParameterDescription
string The input string.
allowed_tags optional Tags to keep, as "<b><i>" or ["b", "i"].

Return value

The string without tags.

Examples

Remove all tagsTry it yourself
<?php
echo strip_tags("<p>Hello <b>World</b></p>"), "\n";

Output

Hello World
Allow some tagsTry it yourself
<?php
echo strip_tags("<p>Keep <b>bold</b> and <i>italic</i></p>", ["b", "i"]), "\n";

Output

Keep <b>bold</b> and <i>italic</i>

Common mistakes

  • Allowed tags keep their attributes, including onclick, so strip_tags() alone isn't safe for user HTML. Escape with htmlspecialchars(), or use an HTML sanitiser library.

Version history

VersionChange
PHP 4.0Added
PHP 7.4allowed_tags can be an array of tag names.
  • htmlspecialchars() · Convert &, <, >, " and ' to HTML entities so user text is shown as text, not run as HTML. The main defence against XSS.
  • html_entity_decode() · Convert HTML entities such as &amp;, &lt; and &eacute; back into the characters they stand for.
  • PHP Strings · tutorial

Was this page helpful?