# Is strip\_tags enough for removing XSS?

**URL:** https://forum.kirupa.com/t/is-strip-tags-enough-for-removing-xss/298174
**Category:** Uncategorized
**Created:** [October 14, 2009, 6:31pm UTC](https://forum.kirupa.com/t/is-strip-tags-enough-for-removing-xss/298174 "2009-10-14T18:31:46Z")
**Posts on this page:** 1
**Page:** 1

<div class="post-metadata">

### Author: ![NeoDreamer](https://avatars.discourse-cdn.com/v4/letter/n/ccd318/32.png) [@NeoDreamer](https://forum.kirupa.com/u/NeoDreamer)
#### Post date: [October 14, 2009, 6:31pm UTC](https://forum.kirupa.com/t/is-strip-tags-enough-for-removing-xss/298174/1 "2009-10-14T18:31:46Z")

</div>

A few PHP frameworks that I’ve seen have specific functions to remove XSS attacks. I believe that they just remove the \<script\> tag (I could be wrong). If I had previously used strip\_tags on a string, was that enough to remove all XSS attacks or should I follow up with one of these framework XSS functions? A more general question is whether XSS attacks can exist without HTML tags.