David JM Emmett's Profile

1

Prelude: I prefer to use an MVC Style architecture.

I've always thought that the best way to go about things is to structure your code so that the View is a series of calls to a DOMDocument using PHP DOM XML.

Personally, I find this to be the best and safest way to validate user's HTML input, I load the users input into a DOMNode and remove all attributes that I think may be dangerous.

Posted in /blog/2007/mar/allowing-html-and-preventing-xss.

Wed, 14 Jan 2009 at 09:37:27: Link