Sanitising user inputs and user inputted data outputs I am creating a function for sanitising user inputs and user inputted data outputs.

Please offer advise on any improvements which could be made:

function cleanse($input) {

    $search = array(
        '@&lt;script[^&gt;]*?&gt;.*?&lt;/script&gt;@si',   // Strip out javascript
        '@&lt;[\/\!]*?[^&lt;&gt;]*?&gt;@si',            // Strip out HTML tags
        '@&lt;style[^&gt;]*?&gt;.*?&lt;/style&gt;@siU',    // Strip style tags properly
        '@&lt;![\s\S]*?--[ \t\n\r]*&gt;@'         // Strip multi-line comments
    );

    $output = preg_replace($search, '', $input);
    return $output;
}

function sanitise($input) {
    if (is_array($input)) {
        foreach($input as $var=&gt;$val) {
            $output[$var] = sanitize($val);
        }
    } else {
        $input  = cleanse($input);
        $output = htmlspecialchars($input, ENT_QUOTES,'UTF-8',false);
    }
    return $output;
}
Personally I tend to work with a white-list of characters.

So instead of sanitizing and removing bad stuf, I simply only accept good stuff.
e.g. [0-9]+ when validating an age field

This approach is less error prone because you don't have to think of all the bad things one can enter. And you know that the data you are serving is actualy what you tink it is (e.g. a number when referencing age).