index.xhtml

   1 <?xml version="1.0" encoding="UTF-8"?>
   2 <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
   3     "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
   4 <html
   5   xmlns="http://www.w3.org/1999/xhtml"
   6   xmlns:xi="http://www.w3.org/2001/XInclude"
   7   xmlns:xc="urn:xhtml-compiler"
   8   xml:lang="en">
   9 <head>
  10 <title>HTML Purifier - Filter your HTML the standards-compliant way!</title>
  11 <xi:include href="common-meta.xml" xpointer="xpointer(/*/node())" />
  12 <meta name="description"
  13   content="HTML filter that guards against XSS and ensures standards-compliant output." />
  14 <meta name="keywords"
  15   content="HTMLPurifier, HTML Purifier, HTML, filter, filtering, standards, compliant, w3c, XSS, PHP, security, library, open source, LGPL, whitelist" />
  16 <!-- See news.xhtml for definition -->
  17 <link rel="alternate" type="application/rss+xml" title="News - HTML Purifier" href="news.rss" />
  18 <script defer="defer" type="text/javascript" src="del.icio.us.js" xc:absolute="src"></script>
  19 <!-- OpenID for Edward Z. Yang -->
  20 <link rel="openid.server" href="https://pip.verisignlabs.com/server" />
  21 <link rel="openid.delegate" href="http://edwardzyang.pip.verisignlabs.com/" />
  22 <!-- Google OpenSearch -->
  23 <link rel="search" href="opensearchdescription.xml"
  24   type="application/opensearchdescription+xml"
  25   title="HTML Purifier" />
  26 </head>
  27 <body>
  28
  29 <div id="branding">
  30   <h1>
  31     <span class="html">HTML</span>
  32     <span class="purifier">Purifier</span>
  33   </h1>
  34   <blockquote>
  35     <p>
  36       Standards-Compliant HTML Filtering
  37     </p>
  38   </blockquote>
  39 </div>
  40
  41 <xi:include href="common-navigation.xml" xpointer="xpointer(/*/node())" />
  42
  43 <div id="content">
  44
  45 <div id="summary">
  46   <h2>Summary</h2>
  47   <div id="summary-safe">
  48     <h3>Safe</h3>
  49     <p>
  50       HTML Purifier defeats XSS with an audited whitelist
  51     </p>
  52   </div>
  53   <div id="summary-clean">
  54     <h3>Clean</h3>
  55     <p>
  56       HTML Purifier ensures standards-compliant output
  57     </p>
  58   </div>
  59   <div id="summary-open">
  60     <h3>Open</h3>
  61     <p>
  62       HTML Purifier is open-source and highly customizable
  63     </p>
  64   </div>
  65 </div>
  66
  67 <div id="intro">
  68   <div class="warning" style="margin-left:0; margin-right:0;">
  69     <strong>Most recent release is a security update.</strong> Please upgrade
  70     to HTML Purifier 3.1.1 or 2.1.5 as soon as possible.
  71   </div>
  72
  73   <p><strong>HTML Purifier</strong> is a standards-compliant
  74   <abbr>HTML</abbr> filter library written in
  75   <abbr>PHP</abbr>. HTML Purifier will not only remove all malicious
  76   code (better known as <abbr>XSS</abbr>) with a thoroughly audited,
  77   secure <em>yet</em> permissive <strong><a
  78   href="live/smoketests/printDefinition.php">whitelist</a></strong>,
  79   it will also make sure your documents are
  80   <strong>standards compliant</strong>, something only achievable with a
  81   comprehensive knowledge of <abbr>W3C</abbr>'s specifications.
  82   Tired of using BBCode due to the current landscape of deficient or
  83   insecure <abbr>HTML</abbr> filters? Have a
  84   <strong><acronym>WYSIWYG</acronym></strong> editor but never been able to use it? Looking
  85   for high-quality, standards-compliant, open-source components for that
  86   application you're building? HTML Purifier is for you!</p>
  87
  88   <blockquote class="fancy">
  89   <div class="quote">
  90       I'd just like to say we use HTML Purifier in <a href="http://www.iris.ac/">IRIS</a> for
  91       filtering emails against XSS attacks and we've been more than impressed.
  92   </div>
  93   <div class="origin">&mdash; Chris Corbyn, <em>Senior IRIS Developer</em></div>
  94   </blockquote>
  95
  96   <xi:include href="download-box.xml" xpointer="xpointer(/*/node())" />
  97
  98 </div>
  99
 100 <h2 id="Background" class="clear">Background</h2>
 101
 102 <p>There are a number of open-source <abbr>HTML</abbr> filtering solutions out
 103 there on the web already
 104 (i.e. <acronym>PEAR</acronym>'s
 105 <a href="http://pear.php.net/package/HTML_Safe">HTML_Safe</a>,
 106 <a href="http://sourceforge.net/projects/kses">kses</a>
 107 and
 108 <a href="http://simon.incutio.com/archive/2003/02/23/safeHtmlChecker">
 109 SafeHtmlChecker.class.php</a>).  What sets HTML Purifier apart from them?
 110 Aren't all of these choices <q>secure</q>?</p>
 111
 112 <p>When it comes to <abbr>HTML</abbr>, <strong>attention to
 113 detail</strong> is key. Does the library demonstrate an in-depth
 114 knowledge of the <abbr>DTD</abbr> that defines
 115 <abbr>HTML</abbr>? Does it perform its filtering off a robust
 116 whitelist rather than a usually out-dated blacklist? Does it go through
 117 the care to check every single attribute in the document for validity?
 118 Does it actually understand tag markup, or pay lip-service with a series
 119 of deficient regexes and str_replace's?</p>
 120
 121 <p>Somewhere along the way, all of HTML Purifier's predecessors fall
 122 flat. HTML_Safe dooms itself to attacks of the future by using a
 123 blacklist. Configurable filters like kses and PHP Input Filter still
 124 cannot validate the contents inside attributes. With all these gaps in
 125 coverage, none of the usual libraries come close to achieving
 126 <strong>standards-compliance</strong>. There is a user-unfriendly,
 127 draconic <abbr>XML</abbr>-based filter called Safe HTML Checker,
 128 but even it forgets that <code>&lt;a&gt;</code> tags cannot be nested
 129 within each other!</p>
 130
 131 <p><strong>Know thy enemy.</strong> Wily hackers have a huge arsenal of
 132 <abbr>XSS</abbr> hidden within the depths of the
 133 <abbr>HTML</abbr> specification. HTML Purifier takes its
 134 effectiveness from the fact that it will decompose the whole document
 135 into tokens, and rigorously process the tokens by removing
 136 non-whitelisted elements, transforming bad practice tags like font into
 137 span, properly checking the nesting of tags and their children and
 138 validating all attributes according to their <abbr>RFC</abbr>s.
 139 HTML Purifier's comprehensive algorithms are complemented by a
 140 <strong>breadth of knowledge</strong>, ensuring that richly formatted
 141 documents pass through unstripped.</p>
 142
 143 <p>To my knowledge, there is nothing else in the wild that offers
 144 protection from <abbr>XSS</abbr>, standards-compliance, and the
 145 corrective processing of poorly formed <abbr>HTML</abbr>
 146 simultaneously. Don't take my word for it though:
 147 do your research. Investigate the other libraries, and decide for
 148 yourself who you would prefer to be the <strong>gatekeeper</strong> to
 149 your system.</p>
 150
 151 <p>To find out more, you can read the
 152 <a href="comparison.html"><strong>Comparison</strong></a>
 153 for a play-by-play analysis of the major filter libraries currently
 154 out there.</p>
 155
 156 <blockquote class="fancy">
 157 <div class="quote">
 158     [Y]ou save my day by allowing me not to write another damned HTML parser.
 159 </div>
 160 <div class="origin">
 161     &mdash; Joseph Halter, <em>Technical Director at Akira Web</em>
 162 </div>
 163 </blockquote>
 164
 165 <h2 id="Plugins">Plugins</h2>
 166
 167 <p>HTML Purifier is a great library to integrate with existing
 168 <abbr>CMS</abbr>es and other applications or <acronym>WYSIWYG</acronym>
 169 editors.  Currently, we have plugins for these applications:</p>
 170
 171 <ul>
 172     <li><a href="http://www.phorum.org/phorum5/read.php?62,127035">Phorum</a> (in use at our very own forums!)</li>
 173     <li><a href="http://htmlpurifier.org/svnroot/htmlpurifier/trunk/plugins/modx.txt">MODx</a></li>
 174     <li><a href="http://bart.motd.be/projects/html-purifier-drupal-module">Drupal</a> by Bart Jansens</li>
 175     <li><a href="http://urbangiraffe.com/plugins/html-purified/">Wordpress</a> by John Godley</li>
 176     <li><a href="http://extensions.joomla.org/component/option,com_mtree/task,viewlink/link_id,4094/Itemid,35/">Joomla</a> by Double D</li>
 177     <li><a href="http://www.mindloop.be/nieuws/nieuwe-ontwikkelingen/htmlpurifier-and-the-codeigniter-framework">CodeIgniter</a> by Andy Mathijs</li>
 178 </ul>
 179
 180 <p>
 181     <strong>Notice:</strong>
 182     Any plugin provided by a third party has not been vetted by us: use
 183     them at your own risk. If you are having a problem with the plugin,
 184     please consult the plugin author before asking for help here (we'll
 185     be more than happy to help, but it might be a problem with the
 186     plugin rather than HTML Purifier.)
 187 </p>
 188
 189 <blockquote class="fancy">
 190 <div class="quote">
 191     This plugin is on top of my favorite list[.] I am going to heavily
 192     depend on it since my clients insist on having <acronym>WYSIWYG</acronym> and I insist on
 193     having pages that validate and are semantically sound.
 194 </div>
 195 <div class="origin">
 196     &mdash; David Molliere, <em>MODx Marketing &amp; Design Team</em>
 197 </div>
 198 </blockquote>
 199
 200 <p>Plugins for other major applications gladly accepted!</p>
 201
 202
 203 <h2 id="Users">Users</h2>
 204
 205 <p>Here are some open-source applications that use HTML Purifier:</p>
 206
 207 <table>
 208     <tr><td><a href="http://www.aliro.org/">Aliro</a></td><td><a href="http://aliro-svn.cvsdude.com/aliro/trunk/extclasses/HTMLPurifier.php">3.1.0</a></td></tr>
 209     <tr><td><a href="http://code.google.com/p/jibberbook/">Jibberbook</a></td><td><a href="http://jibberbook.googlecode.com/svn/trunk/source/htmlpurifier/HTMLPurifier.standalone.php">3.1.0</a></td></tr>
 210     <tr><td><a href="http://brilaps.com/index.php?content=mia">Mia</a></td><td><a href="http://code.google.com/p/mia-chat/source/browse/trunk/mia_0_8_x/includes/htmlpurifier/HTMLPurifier.php">3.1.0</a></td></tr>
 211     <tr><td><a href="http://kohanaphp.com/home.html">Kohana</a></td><td><a href="http://trac.kohanaphp.com/browser/trunk/system/vendor">3.1.0</a></td></tr>
 212     <tr><td><a href="http://www.midgard-project.org/">Midgard</a></td><td>via PEAR</td></tr>
 213     <tr><td><a href="http://www.bitweaver.org/">BitWeaver</a></td><td><a href="http://www.bitweaver.org/wiki/HTMLPurifier">via PEAR</a>, see <a href="http://bitweaver.cvs.sourceforge.net/bitweaver/_bit_install/install_checks.php?view=markup">install_checks.php</a></td></tr>
 214     <tr><td><a href="http://code.google.com/p/project-babel/issues/entry">Project Babel</a></td><td>via PEAR and Midgard</td></tr>
 215     <tr><td><a href="http://code.google.com/p/php-atompub-server/">PHP Atompub Server</a></td><td><a href="http://code.google.com/p/php-atompub-server/wiki/SanitizingInput">via download</a></td></tr>
 216 </table>
 217
 218 <p>If I've forgotten anyone, drop me a line with a link to both
 219 your application and the use of HTML Purifier in your code repository,
 220 and I'll add your application to this list.</p>
 221
 222 <h3>Hall of Limbo: PHP4</h3>
 223
 224 <p>The following applications are using HTML Purifier 2.1, for PHP4 compatibility.
 225 While this is fine, I would much rather they go PHP5!</p>
 226
 227 <table>
 228     <tr><td>There are currently no applications using an up-to-date version of HTML Purifier 2.1.</td></tr>
 229 </table>
 230
 231
 232 <h3>Hall of the Past</h3>
 233
 234 <p>The following projects package HTML Purifier with their software, but are
 235 not up-to-date. They are putting their userbase at risk of security attacks
 236 by not keeping HTML Purifier updated. If you're a user or developer for these projects, please
 237 raise your voice and help to get them fixed!</p>
 238
 239 <table>
 240     <tr><td><!--<a href="http://code.google.com/p/wpids/">-->WPIDS<!--</a>--></td><td><a href="http://code.google.com/p/wpids/source/browse/trunk/htmlpurifier/HTMLPurifier.php">3.0.0</a></td></tr>
 241     <tr><td><!--<a href="http://noserub.com/">-->NoseRub<!--</a>--></td><td><a href="http://code.google.com/p/noserub/source/browse/trunk/vendors/htmlpurifier/HTMLPurifier.php">3.0.0</a></td></tr>
 242     <tr><td><!--<a href="http://getlilina.org/">-->Lilina News Aggregator<!--</a>--></td><td><a href="http://lilina.googlecode.com/svn/trunk/lilina/inc/contrib/HTMLPurifier.standalone.php">2.1.3</a></td></tr>
 243     <tr><td><!--<a href="http://info.tikiwiki.org/tiki-index.php">-->TikiWiki<!--</a>--></td><td><a href="http://tikiwiki.svn.sourceforge.net/viewvc/tikiwiki/branches/1.10/lib/HTMLPurifier.php?view=markup">2.1.3</a></td></tr>
 244     <tr><td><!--<a href="http://code.google.com/p/xoopsbrasil/">-->XOOPS Cube BRASIL<!--</a>--></td><td><a href="http://code.google.com/p/xoopsbrasil/source/browse/xoops_trust_path/PEAR/HTMLPurifier.php">2.1.3</a></td></tr>
 245     <tr><td>Lichen Webmail</td><td><a href="http://trac.lichen-mail.org/browser/trunk/libs/HTMLPurifier.php">2.0.1</a>, see <a href="https://trac.lichen-mail.org/ticket/79">ticket #79</a></td></tr>
 246     <tr><td>PHProjekt</td><td><a href="http://thinkforge.org/plugins/scmcvs/cvsweb.php/phprojekt50/lib/html/library/HTMLPurifier.php?rev=HEAD;content-type=text%2Fplain;cvsroot=phprojekt5">1.6.0</a></td></tr>
 247     <tr><td>XDForum</td><td><a href="http://xdforum.svn.sourceforge.net/viewvc/xdforum/trunk/xdforum/includes/htmlpurifier/library/HTMLPurifier.php?view=markup">1.3.2</a></td></tr>
 248 </table>
 249
 250 <h2 id="Propaganda">Spread the Word!</h2>
 251
 252 <p>Help spread awareness about HTML Purifier by:</p>
 253
 254 <ul>
 255 <li><a
 256 href="http://del.icio.us/post?v=4&amp;noui&amp;url=http://htmlpurifier.org/&amp;title=HTML%20Purifier%20-%20Filter%20your%20HTML%20the%20standards-compliant%20way!"
 257 id="delicious">Bookmarking this website</a> on your <strong>del.icio.us</strong> account, and/or</li>
 258 <li>
 259     <div>Including this little <strong>label</strong> on your website:
 260     <a href="http://htmlpurifier.org/"><img
 261     src="live/art/powered.png"
 262     alt="Powered by HTML Purifier" border="0" /></a>, with this code:
 263     </div>
 264     <pre class="long">&lt;a href=&quot;http://htmlpurifier.org/&quot;&gt;&lt;img
 265 src=&quot;http://htmlpurifier.org/live/art/powered.png&quot;
 266 alt=&quot;Powered by HTML Purifier&quot; border=&quot;0&quot; /&gt;&lt;/a&gt;</pre>
 267 </li>
 268 </ul>
 269
 270 </div>
 271
 272 </body>
 273 </html>