<?xml version="1.0"?>
<rss version="2.0">
  <channel>
    <title>PHPDeveloper.org</title>
    <link>http://www.phpdeveloper.org</link>
    <description>Up-to-the Minute PHP News, views and community</description>
    <language>en-us</language>
    <pubDate>Sat, 18 May 2013 23:00:14 -0500</pubDate>
    <ttl>30</ttl>
    <item>
      <title><![CDATA[Chris Shiflett's Blog: Allowing HTML and Preventing XSS]]></title>
      <guid>http://www.phpdeveloper.org/news/7444</guid>
      <link>http://www.phpdeveloper.org/news/7444</link>
      <description><![CDATA[<p>
In <a href="http://shiflett.org/blog/2007/mar/allowing-html-and-preventing-xss">this new post</a> to his blog, <i>Chris Shiflett</i> helps to solve one of the problems that several web designers face when allowing user input but wanting to protect themselves as well - allowing HTML while preventing a user from including a cross-site scripting issue.
</p>
<blockquote>
This problem comes up more and more often due to the rise of social networking and other Web 2.0 properties that embolden users. [...] Of course, BBCode inevitably comes up during these types of discussions, but I really hate the idea of using yet another markup language just because I'm too lazy to deal with HTML, especially if the markup language doesn't even try to be user-friendly.
</blockquote>
<p>
He <a href="http://shiflett.org/blog/2007/mar/allowing-html-and-preventing-xss">looks for a good solution</a>, one that doesn't require learning a new markup or becoming overly complex (while avoiding strip_tags). He provides several chunks of code for different aspects of the method - first make the content safe, then move backwards in the translation for the items you want to allow. 
</p>]]></description>
      <pubDate>Fri, 16 Mar 2007 09:23:00 -0500</pubDate>
    </item>
  </channel>
</rss>
