title: Stop users from entering PHP code in textarea?
body: <p>I have a PHP page with textareas that users can change, and their values get saved and displayed on another PHP page - I'm afraid this could be vulnerable to XSS attacks (or whatever malicious hackers are using today)... I see <a href="http://htmlpurifier.org" rel="nofollow">http://htmlpurifier.org</a> is a nice solution to avoid XSS attacks, and I read in an SO thread that PHP code entered into a textarea is ignored by browsers and not executed server-side.  I just want to know if htmlpurifier will protect my site fully and if there's any chance that old browsers like IE6 aren't smart enough to ignore PHP code like that.  It's my first time making a complex site so I'm tip-toeing around the topic of security... Thanks :)</p>
  
  <p>On a side note, I've used stripslashes and nl2br to avoid formatting issues with apostrophes and line breaks, but is there anything else I should be using to avoid unexpected display issues?</p>