PHP site preventing XSS a bit too wel

Question

I have a blog system where random people can post comments. If naughty people try to post Javascript, this will happen:

bla bla <script>alert("Hacked")</script>

Turns into

bla bla <script>alert("Hacked")</script>

I would prefer the post to keep the code intact, just in case someone ever needs to post HTML. How do I make the second line look like the first, without it actually doing anything? The current way I filter it is:

$safeMessage = htmlspecialchars($reply['message'], ENT_QUOTES | ENT_HTML401, 'UTF-8');

echo "$safeMessage";

Answer 1

The Best way I can think of is using HTML Purifier and specify only a subset of HTML you want to allow. Check documentation here