codeguy/php-the-right-way — pull request #99 by padraic (2012-07-12 18:59:45+00:00)
Title: Updated Data Filtering section about "sanitisation"

- Highlighted difference between sanitisation (changes values) and escaping (preserves values)
- Emphasised reliance on HTMLPurifier for HTML sanitisation
- Added link to Zend\Escaper as a reference set of escaping functions by HTML context
- Noted Markdown/BBCode fallacy! Markdown accepts literal HTML (see spec) - MUST be sanitised after rendered to HTML. BBCode URLs often allow javascript: schema. Libraries usually do not sanitise output after rendering which does allow for XSS injections most of the time.