strip_tags()

Introduction

The strip_tags() function in PHP removes HTML, XML, and PHP tags from a string, leaving only the plain text content. It is commonly used to turn user-submitted or rich-text content into clean, tag-free text — for example, when generating a short summary, a plain-text email body, or a safe-to-store version of a comment.

This article covers the syntax, both required and optional parameters, practical examples, the array form added in PHP 7.4, and the important security caveats you need to understand before relying on it.

Understanding the strip_tags() function

The strip_tags() function scans the input string and deletes anything that looks like an HTML/XML tag (text between < and >) as well as PHP tags (<?php ... ?>). The text that sits between the tags is kept. The syntax is as follows:

The PHP syntax of the strip_tags()

strip_tags(string $string, array|string|null $allowed_tags = null): string

Here is what each parameter does:

• $string — the input string to strip tags from. This is the only required parameter.
• $allowed_tags (optional) — a list of tags that should not be removed. You can pass it as a string of tag names ("<a><b>") or, since PHP 7.4, as an array (["a", "b"]). When omitted (or null), every tag is removed.

The function returns the resulting string with all non-allowed tags removed. It never modifies the original string.

Heads up: comments (<!-- ... -->) and <?php ... ?> blocks are always stripped and cannot be added to the allowlist.

Example Usage

Let's look at an example to understand the usage of the strip_tags() function in PHP:

Example of PHP strip_tags()

In the example above, we use the strip_tags() function to remove all HTML and PHP tags from the string. The resulting string Hello WorldThis is a paragraph. is then displayed on the screen using the echo statement.

Using the $allowable_tags parameter

Let's look at another example to understand how the $allowable_tags parameter can be used with the strip_tags() function:

How to use PHP strip_tags()?

In the example above, we use the strip_tags() function to remove HTML and PHP tags from the string. We specify the <a> tag as an allowable tag using the $allowed_tags parameter. As a result, the function removes the <h1> and <p> tags but preserves their text content, while keeping the <a> tag and its content intact. The resulting string Hello WorldThis is a paragraph.<a href='https://www.example.com'>Example link</a> is then displayed on the screen using the echo statement.

Passing allowed tags as an array (PHP 7.4+)

Since PHP 7.4 you can pass the allowed tags as an array instead of a string. This is easier to read and less error-prone than building a "<a><b>" style string:

<?php

$str = "<p>Hi</p><b>bold</b><i>italic</i>";

// String form (any PHP version)
echo strip_tags($str, "<p><b>"); // <p>Hi</p><b>bold</b>italic

echo "\n";

// Array form (PHP 7.4 and newer) — equivalent result
echo strip_tags($str, ["p", "b"]); // <p>Hi</p><b>bold</b>italic

Both calls keep the <p> and <b> tags and strip the <i> tag, printing <p>Hi</p><b>bold</b>italic on each line.

Note: strip_tags() does not validate HTML. It simply removes tags based on the provided allowlist, which may leave malformed markup or unclosed tags in the output.

Security: strip_tags() is not enough to stop XSS

A common misconception is that strip_tags() makes user input safe to display. It does not. The function only removes whole tags — it does not sanitize the attributes of any tag you allow:

<?php

$input = '<a href="javascript:alert(1)" onclick="steal()">click me</a>';

// The <a> tag survives, attributes and all
echo strip_tags($input, "<a>");
// <a href="javascript:alert(1)" onclick="steal()">click me</a>

The dangerous href and onclick attributes pass straight through. For output that will be rendered as HTML, use htmlspecialchars() to escape the text, or a dedicated HTML sanitizer such as HTML Purifier when you need to allow some markup safely. Use strip_tags() to produce plain text, not to produce safe HTML.

Common use cases

• Plain-text previews: generate a tag-free snippet of an article for search results or list views.
• Plain-text email bodies: strip HTML before sending the text alternative of an email.
• Cleaning user input that should never contain markup, such as a display name or a search query.

Related functions

• htmlspecialchars() — escape <, >, &, and quotes so markup renders as text instead of being removed.
• htmlentities() — convert all applicable characters to HTML entities.
• trim() — remove surrounding whitespace, often paired with strip_tags() to tidy the result.

Conclusion

The strip_tags() function is a straightforward tool for extracting plain text from strings containing HTML or PHP markup. Pass an allowlist (as a string, or an array in PHP 7.4+) when you need to keep specific tags, and remember that it removes tags only — it does not sanitize attributes, so it is not a substitute for proper output escaping. Use it to produce plain text, and reach for htmlspecialchars() or a real sanitizer when you need safe HTML.

Practice