html dangerous tags to avoid while developing a chat application

Question

I am developing a chat application using PHP and jQuery... all messages sent by the chat pair are appended to a <div>. While doing this, I found that tags such as <script> can be entered by users. What tags should I avoid while appending the user's message?

Answer 1

Avoid tags that will inject content into the page:

• applet
• script
• style
• link
• iframe

Other tags may be necessary to remove, as well. Maybe you don't want to embed images. These are things that you will need to determine. At the bare minimum, allow <p> and <br />.