fplanque: dev blog

Link: http://simon.incutio.com/archive/2003/02/23/safeHtmlChecker

by Simon Willison

The system I have implemented works by running submitted posts through an XML parser, which checks that each element is in my list of allowed elements, is nested correctly (you can't put a blockquote inside a p for example) and doesn't have any illegal attributes. My initial test have shown it to work pretty well, but if anyone wants to have a go at breaking it please, be my guest.