# Preventing HTML tags

**URL:** <https://forums.knack.com/t/preventing-html-tags/20090>\
**Category:** Get Answers\
**Created:** [December 12, 2025, 3:50am UTC](https://forums.knack.com/t/preventing-html-tags/20090 "2025-12-12T03:50:11Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![Joseph7](https://avatars.discourse-cdn.com/v4/letter/j/e9c0ed/32.png) [@Joseph7](https://forums.knack.com/u/Joseph7)\
**Post date:** [December 12, 2025, 3:50am UTC](https://forums.knack.com/t/preventing-html-tags/20090/1 "2025-12-12T03:50:11Z")

</div>

Does anyone know of a good way to prevent users from using html tags, perhaps using Javascript? The restrictions under **Settings \> Security** aren’t robust enough. We have found that we can inject iframe, span and other tags into many User fields (phone, link, RTF). We can use many, many validation rules for each field, but that’s pretty tedious. All thoughts are good thoughts, and thanks in advance.