ushahidi/Ushahidi_Web — pull request #1056 by rjmackay (2013-04-09 03:07:01+00:00)
Title: Better XSS protection

* Add HTMLPurifier library (LGPL)
* Add helper functions to html helper
* Set default encoding header to UTF-8
* Make sure the doctype is the same everywhere (admin/members/frontend)
* Remove use of strip_tags() and htmlspecialchars()
* Replace vanilla htmlentities with html::escape() - make sure no one forgets the UTF-8
* Remove _csv_text() fn - no longer used and was using strip_tags()

Feedback appreciated.

Particularly around the range of allowed tags, current: "a[href|title],p,img[src|alt],br,b,u,strong,em,i" and iframes from trusted sources: youtube, vimeo, soundcloud

Other iframes we should allow? Other tags we should allow?

Also on names of helper fns:
html::escape()
html::clean()
html::strip_tags()