A basic whitelist to prevent XSS.

xss_whitelist.php

<?php
function xss_whitelist($input, $limit = null, $offset = 0)
{
  // Force input to be a string0
	$x = (string) $input;

	// Allow alphanumeric characters, whitespace, and specific characters
	$x = preg_replace("/[^a-zA-Z0-9 -:,.!?\/|]/", "",$x);

	// Limit characters
	if ($limit) {
		$x = substr($x, $offset, $limit);
	}

	// Convert characters to HTML entities and return the sanitized string
	return htmlentities($x, ENT_QUOTES, 'UTF-8');
}
?>