title: Strip php tags from user-created code
body: <p>I have a webpage where users can edit, create, store, access and debug their HTML codes online. For security purpuses I am already using a sandboxed iframe to display the user content, but there is one more thing I've though about - what if the user created code contains a php tag (my serverside language is php) that, for instance, makes an SQL query and reads/deletes all of my databases or does anything else that is harmful?</p>
  
  <p>Is it possible? If yes - how can I defend myself against this type of attack? I do know that php has an option to strip all tags with certain tagnames, so I can strip all the php tags, but then again - can the users still not use other hacks, such as document.write() the php tag or something like that?</p>
  
  <p>Thank you in advance</p>