title: TinyMCE, PHP and MySQL: security and escaping questions
body: <p>I'm implementing TinyMCE for a client so they can edit front-end content via a simple, familiar interface in their site's admin panel.</p>
  
  <p>I have never used TinyMCE before but notice that you are able to insert whatever markup you want and it will be happily saved off to the MySQL database, assuming you don't escape the contents of the TinyMCE  before running it through your query.</p>
  
  <p>You can even insert single quotes and have it break your SQL query entirely.</p>
  
  <p>But of course, when I do escape the contents, benign presentational stuff like paragraph tags get converted to HTML entities and so the whole point of the WYSIWYG editor is defeated, because the entities are spat back out when it comes to displaying the stored content on the front-end.</p>
  
  <p>So is there a way I can "selectively escape" content from TinyMCE, to keep the innocent tags like P and BR but get rid of dangerous ones like SCRIPT, IFRAME, etc.? I really don't want to have to manually encode and decode them using str_replace() or whatever, but I'd rather not give my client a gaping security hole either.</p>
  
  <p>Thanks.</p>