Note: This is a historical reference, not a current security baseline. Magento 1 is end-of-life.

Problem description

HTML tags are not allowed in SKU attribute error is thrown on attempt to edit product in Magento backend at Catalog > Manage products > Product page.

Cause

SKU attribute value contains HTML tags and it is not allowed since SUPEE-10570 or Magento 1.9.3.8 version, SKU attribute requirements were hardened by the following code added to Mage_Adminhtml_Catalog_ProductController controller in app/code/core/Mage/Adminhtml/controllers/Catalog/ProductController.php:
--- app/code/core/Mage/Adminhtml/controllers/Catalog/ProductController.php
+++ app/code/core/Mage/Adminhtml/controllers/Catalog/ProductController.php
@@ -723,6 +723,16 @@ class Mage_Adminhtml_Catalog_ProductController extends Mage_Adminhtml_Controller
             $this->_filterStockData($data['product']['stock_data']);
 
             $product = $this->_initProductSave();
+            // check sku attribute
+            $productSku = $product->getSku();
+            if ($productSku && $productSku != Mage::helper('core')->stripTags($productSku)) {
+                $this->_getSession()->addError($this->__('HTML tags are not allowed in SKU attribute.'));
+                $this->_redirect('*/*/edit', array(
+                    'id' => $productId,
+                    '_current' => true
+                ));
+                return;
+            }
 
             try {
                 $product->save();

Solution

Edit SKU attrubute value and delete all HTML tags (, , etc.) If it is not possible due to some reason, you can rollback modifications in the code listed in Cause section which imposed such restrictions (by copying app/code/core/Mage/Adminhtml/controllers/Catalog/ProductController.php into app/code/local/Mage/Adminhtml/controllers/Catalog/ProductController.php and changing local copy).