php - Apply htmlentities to stripped tags -

researched links:

how apply htmlentities selectively? , php function strip tags, except list of whitelisted tags , attributes

they close not expected.

what have tried?

<?php define('charset', 'utf-8'); define('replace_flags', ent_html5);  function htmlcleaned($string) {     $string = htmlentities($string);     return str_replace(     array("&lt;i&gt;", "&lt;b&gt;", "&lt;/i&gt;", "&lt;/b&gt;", "&lt;p&gt;", "&lt;/p&gt;"),     array("<i>", "<b>", "</i>", "</b>", "<p>", "</p>"), $string); }  echo htmlcleaned("<p>how you?</p><p><b>this bold</b></p><p><i>this italic</i></p><p><u>this underline</u></p><p><br></p><ul><li>this list item 1</li><li>this list item 2</li></ul><p><br></p><ol><li>this ordered list item 1</li><li>this ordered list item 2</li></ol><p><a target='_blank' style='color: #1c5c76;' href='http://www.google.com'>http://www.google.com</a></p><p>this plain text again.<br></p><script>alert('attempt csrf');</script><p><p>this p tag example</p></p>"); ?> 

what want achieve?

if input is:

<b><script>alert("something");</script></b> 

then output be:

<b>&lt;script&rt;("something");&lt;/script$rt;</b> 

there no specific blacklist there specific white list.

this function might you, not highly tested. htmlentities on tags except tags specify

function html_entity_decode_matches($matches){     return html_entity_decode($matches[0]);  } function htmlentities_exclude($string, $exclude_array){     $string = htmlentities($string); //htmlentities     $ent_sl = "&gt;"; //>     if (is_array($exclude_array) , !empty($exclude_array)){         foreach($exclude_array $exc){             $exc = str_replace(array("<", ">"), "", $exc);             $ent = str_replace("/", "\/", htmlentities("<{$exc}"));             $ent_e = str_replace("/", "\/", htmlentities("</{$exc}>"));             //do decode on <tag...>             $string = preg_replace_callback("/{$ent}(.*?){$ent_sl}/", "html_entity_decode_matches", $string);             //do decode on <\tag>             $string = preg_replace_callback("/{$ent_e}/", "html_entity_decode_matches", $string);         }     }     return $string; } 

---

echo htmlentities_exclude('<b><script>alert("something");</script></b>', array("<b>"));  output: <b>&lt;script&gt;alert(&quot;something&quot;);&lt;/script&gt;</b>