I think we need a saferhtml format. I say saferhtml and not safehtml - because it must be appreciated that getting a very safe html accepting format will be difficult. A saferhtml format would ensure that none of these were in the final output:
- php tags (of any type)
- html/xml comments
- any form based tags (input, button, select, ...)
- script tags (<script> and legacy <javascript>)
- object, iframe, applet tags
- javascript events
- unescaped html entities within the text content
- style attributes or embedded style
and would have to ensure that any elements that accept URLs only accept valid ones using the http or https protocols.
- a
- img
- cite
etc.
This is how I suggest it should be done. First, use strip_tags to remove php tags, xml/html comments etc. - but specify a whitelist of tags that we want to keep.
Here’s the full list from w3schools. I have deleted deprecated syntax and elements we should probably exclude from the whitelist.
<a><abbr><acronym><address>
<applet><area><b>
<base><basefont>
<bdo><big><blockquote>
<body>
<button><caption>
<center><cite><code><col><colgroup><dd><del><dfn>
<dir><div><dl><dt><em>
<fieldset><font><form><frame><frameset><head><h1> - <h6><hr>
<html><i>
<iframe><img>
<input><ins>
<isindex><kbd>
<label><legend><li>
<link><map><menu><meta><noframes><noscript><object><ol>
<optgroup><option><p>
<param><pre><q>
<s><samp>
<script><select><small><span>
<strike><strong>
<style><sub><sup><table><tbody><td>
<textarea><tfoot><th><thead>
<title><tr><tt>
<u><ul><var>
<xmp>
Then, pass it through an html validator
like htmlLawed. There are probably plenty of others to choose from. Perhaps we should do some more investigation.
That shouldn’t be too difficult to implement and should be a huge improvement on what we currently have. I wouldn’t bother including a badwords list as part of saferhtml. A badwords list doesn’t make it any safer in my opinion - it just provides an option to exclude posts that contain certain words you don’t like.
☆ A M B ☆
