fgetss()

What is the fgetss() Function?

Important: fgetss() was deprecated in PHP 7.3 and removed in PHP 8.0. It will trigger a fatal error (Call to undefined function fgetss()) on any modern PHP version. This page documents what it did and shows the supported replacement — fgets() combined with strip_tags() — so you can read and migrate legacy code.

The fgetss() (short for "file get string, strip") function read a single line from an open file and stripped any HTML and PHP tags from that line before returning it. It behaved exactly like fgets() — reading up to a newline, the supplied length, or end of file — with one extra step: the tags were removed on the way out.

It was effectively shorthand for strip_tags(fgets($handle)), which is precisely why PHP retired it: the same result is one obvious composition of two well-understood functions, so a dedicated function added little value and was easy to misuse for security.

Here's the syntax it used:

The PHP syntax of fgetss()

fgetss(resource $handle, int $length = ?, string $allowable_tags = ?): string|false

Return value: the next line with tags removed, or false when the end of the file is reached or on error.

A common mistake was assuming fgetss() sanitized input safely. It only removed tags via a simple parser — it never neutralized attributes such as onclick= or javascript: URLs. For real output escaping use htmlspecialchars(), not tag stripping.

How to Read and Strip Tags in PHP?

Using the fgetss() function was similar to using the fgets() function. Here are the steps to follow:

1. Open the file using the fopen() function.
2. Use the fgets() function to read a line from the file, then apply strip_tags() to remove any tags.
3. Close the file using the fclose() function.

Here's a complete, self-contained example. It writes a small HTML file, then reads it back line by line with fgets(), stripping tags from each line:

How to Use fgets() and strip_tags()?

<?php

// Create a sample file containing HTML so the example runs on its own
file_put_contents("demo.txt", "<h1>Hello</h1>\n<p>World</p>\n");

$file = fopen("demo.txt", "r");

// Loop until fgets() returns false (end of file)
while (($line = fgets($file)) !== false) {
    // Remove HTML/PHP tags from the line before printing
    echo strip_tags($line);
}

fclose($file);

Output:

Hello
World

A few things to note about this idiom:

• Test the return value, not feof(). Reading with while (($line = fgets($file)) !== false) is more robust than while (!feof($file)), because feof() only becomes true after a failed read — the older loop can process an empty final read. Using a strict !== false comparison also avoids treating a legitimate line such as "0" as the end of the file.
• Keep some tags. fgetss() accepted an allowable_tags argument; strip_tags() does too, so the migration is direct: strip_tags($line, "<b><i>") keeps <b> and <i> while removing everything else.
• Stripping is not sanitizing. If you are rendering untrusted file content in a browser, escape it with htmlspecialchars() instead of (or in addition to) stripping tags.

When you've finished reading, always release the handle with fclose().

Conclusion

The fgetss() function is obsolete: it was deprecated in PHP 7.3 and removed in PHP 8.0, so it must not be used in new code. To read a file line by line while removing HTML or PHP tags, combine fgets() with strip_tags() — pass an allowable_tags argument if you need to keep specific tags. For genuine output safety, reach for htmlspecialchars(). To go deeper on file I/O, see fopen(), feof(), and fclose().

Practice