index.xhtml

   1 <?xml version="1.0" encoding="UTF-8"?>
   2 <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
   3     "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
   4 <html
   5   xmlns="http://www.w3.org/1999/xhtml"
   6   xmlns:xi="http://www.w3.org/2001/XInclude"
   7   xmlns:xc="urn:xhtml-compiler"
   8   xml:lang="en">
   9 <head>
  10 <title>HTML Purifier - Filter your HTML the standards-compliant way!</title>
  11 <xi:include href="common-meta.xml" xpointer="xpointer(/*/node())" />
  12 <meta name="description"
  13   content="HTML filter that guards against XSS and ensures standards-compliant output." />
  14 <meta name="keywords"
  15   content="HTMLPurifier, HTML Purifier, HTML, filter, filtering, standards, compliant, w3c, XSS, PHP, security, library, open source, LGPL, whitelist" />
  16 <!-- See news.xhtml for definition -->
  17 <link rel="alternate" type="application/rss+xml" title="News - HTML Purifier" href="news.rss" />
  18 <script defer="defer" type="text/javascript" src="del.icio.us.js" xc:absolute="src"></script>
  19 <!-- OpenID for Edward Z. Yang -->
  20 <link rel="openid.server" href="https://pip.verisignlabs.com/server" />
  21 <link rel="openid.delegate" href="http://edwardzyang.pip.verisignlabs.com/" />
  22 <!-- Google OpenSearch -->
  23 <link rel="search" href="opensearchdescription.xml"
  24   type="application/opensearchdescription+xml"
  25   title="HTML Purifier" />
  26 </head>
  27 <body>
  28
  29 <div id="branding">
  30   <h1>
  31     <span class="html">HTML</span>
  32     <span class="purifier">Purifier</span>
  33   </h1>
  34   <blockquote>
  35     <p>
  36       Standards-Compliant HTML Filtering
  37     </p>
  38   </blockquote>
  39 </div>
  40
  41 <xi:include href="common-navigation.xml" xpointer="xpointer(/*/node())" />
  42
  43 <div id="content">
  44
  45 <div id="summary">
  46   <h2>Summary</h2>
  47   <div id="summary-safe">
  48     <h3>Safe</h3>
  49     <p>
  50       HTML Purifier defeats XSS with an audited whitelist
  51     </p>
  52   </div>
  53   <div id="summary-clean">
  54     <h3>Clean</h3>
  55     <p>
  56       HTML Purifier ensures standards-compliant output
  57     </p>
  58   </div>
  59   <div id="summary-open">
  60     <h3>Open</h3>
  61     <p>
  62       HTML Purifier is open-source and highly customizable
  63     </p>
  64   </div>
  65 </div>
  66
  67 <div id="intro">
  68   <div class="warning" style="margin-left:0; margin-right:0;">
  69     <strong>Most recent release is a security update.</strong> Please upgrade
  70     to HTML Purifier 3.1.1 or 2.1.5 as soon as possible.
  71   </div>
  72
  73   <p><strong>HTML Purifier</strong> is a standards-compliant
  74   <abbr>HTML</abbr> filter library written in
  75   <abbr>PHP</abbr>. HTML Purifier will not only remove all malicious
  76   code (better known as <abbr>XSS</abbr>) with a thoroughly audited,
  77   secure <em>yet</em> permissive <strong><a
  78   href="live/smoketests/printDefinition.php">whitelist</a></strong>,
  79   it will also make sure your documents are
  80   <strong>standards compliant</strong>, something only achievable with a
  81   comprehensive knowledge of <abbr>W3C</abbr>'s specifications.
  82   Tired of using BBCode due to the current landscape of deficient or
  83   insecure <abbr>HTML</abbr> filters? Have a
  84   <strong><acronym>WYSIWYG</acronym></strong> editor but never been able to use it? Looking
  85   for high-quality, standards-compliant, open-source components for that
  86   application you're building? HTML Purifier is for you!</p>
  87
  88   <blockquote class="fancy">
  89   <div class="quote">
  90       I'd just like to say we use HTML Purifier in <a href="http://www.iris.ac/">IRIS</a> for
  91       filtering emails against XSS attacks and we've been more than impressed.
  92   </div>
  93   <div class="origin">&mdash; Chris Corbyn, <em>Senior IRIS Developer</em></div>
  94   </blockquote>
  95
  96   <xi:include href="download-box.xml" xpointer="xpointer(/*/node())" />
  97
  98 </div>
  99
 100 <h2 id="Background" class="clear">Background</h2>
 101
 102 <p>There are a number of open-source <abbr>HTML</abbr> filtering solutions out
 103 there on the web already
 104 (i.e. <acronym>PEAR</acronym>'s
 105 <a href="http://pear.php.net/package/HTML_Safe">HTML_Safe</a>,
 106 <a href="http://sourceforge.net/projects/kses">kses</a>
 107 and
 108 <a href="http://simon.incutio.com/archive/2003/02/23/safeHtmlChecker">
 109 SafeHtmlChecker.class.php</a>).  What sets HTML Purifier apart from them?
 110 Aren't all of these choices <q>secure</q>?</p>
 111
 112 <p>When it comes to <abbr>HTML</abbr>, <strong>attention to
 113 detail</strong> is key. Does the library demonstrate an in-depth
 114 knowledge of the <abbr>DTD</abbr> that defines
 115 <abbr>HTML</abbr>? Does it perform its filtering off a robust
 116 whitelist rather than a usually out-dated blacklist? Does it go through
 117 the care to check every single attribute in the document for validity?
 118 Does it actually understand tag markup, or pay lip-service with a series
 119 of deficient regexes and str_replace's?</p>
 120
 121 <p>Somewhere along the way, all of HTML Purifier's predecessors fall
 122 flat. HTML_Safe dooms itself to attacks of the future by using a
 123 blacklist. Configurable filters like kses and PHP Input Filter still
 124 cannot validate the contents inside attributes. With all these gaps in
 125 coverage, none of the usual libraries come close to achieving
 126 <strong>standards-compliance</strong>. There is a user-unfriendly,
 127 draconic <abbr>XML</abbr>-based filter called Safe HTML Checker,
 128 but even it forgets that <code>&lt;a&gt;</code> tags cannot be nested
 129 within each other!</p>
 130
 131 <p><strong>Know thy enemy.</strong> Wily hackers have a huge arsenal of
 132 <abbr>XSS</abbr> hidden within the depths of the
 133 <abbr>HTML</abbr> specification. HTML Purifier takes its
 134 effectiveness from the fact that it will decompose the whole document
 135 into tokens, and rigorously process the tokens by removing
 136 non-whitelisted elements, transforming bad practice tags like font into
 137 span, properly checking the nesting of tags and their children and
 138 validating all attributes according to their <abbr>RFC</abbr>s.
 139 HTML Purifier's comprehensive algorithms are complemented by a
 140 <strong>breadth of knowledge</strong>, ensuring that richly formatted
 141 documents pass through unstripped.</p>
 142
 143 <p>To my knowledge, there is nothing else in the wild that offers
 144 protection from <abbr>XSS</abbr>, standards-compliance, and the
 145 corrective processing of poorly formed <abbr>HTML</abbr>
 146 simultaneously. Don't take my word for it though:
 147 do your research. Investigate the other libraries, and decide for
 148 yourself who you would prefer to be the <strong>gatekeeper</strong> to
 149 your system.</p>
 150
 151 <p>To find out more, you can read the
 152 <a href="comparison.html"><strong>Comparison</strong></a>
 153 for a play-by-play analysis of the major filter libraries currently
 154 out there.</p>
 155
 156 <blockquote class="fancy">
 157 <div class="quote">
 158     [Y]ou save my day by allowing me not to write another damned HTML parser.
 159 </div>
 160 <div class="origin">
 161     &mdash; Joseph Halter, <em>Technical Director at Akira Web</em>
 162 </div>
 163 </blockquote>
 164
 165 <h2 id="Plugins">Plugins</h2>
 166
 167 <p>HTML Purifier is a great library to integrate with existing
 168 <abbr>CMS</abbr>es and other applications or <acronym>WYSIWYG</acronym>
 169 editors.  Currently, we have plugins for these applications:</p>
 170
 171 <ul>
 172     <li><a href="http://www.phorum.org/phorum5/read.php?62,127035">Phorum</a> (in use at our very own forums!)</li>
 173     <li><a href="http://htmlpurifier.org/svnroot/htmlpurifier/trunk/plugins/modx.txt">MODx</a></li>
 174     <li><a href="http://bart.motd.be/projects/html-purifier-drupal-module">Drupal</a> by Bart Jansens</li>
 175     <li><a href="http://urbangiraffe.com/plugins/html-purified/">Wordpress</a> by John Godley</li>
 176     <li><a href="http://extensions.joomla.org/component/option,com_mtree/task,viewlink/link_id,4094/Itemid,35/">Joomla</a> by Double D</li>
 177     <li><a href="http://www.mindloop.be/nieuws/nieuwe-ontwikkelingen/htmlpurifier-and-the-codeigniter-framework">CodeIgniter</a> by Andy Mathijs</li>
 178 </ul>
 179
 180 <p>
 181     HTML Purifier is also now in print! Martin Brampton's new book
 182     <a href="http://packt.aliro.org/">PHP 5 CMS Framework Development</a>
 183     includes a discussion of using HTML Purifier in your content management
 184     system. Go check it out!
 185 </p>
 186
 187 <p>
 188     <strong>Notice:</strong>
 189     Any plugin provided by a third party has not been vetted by us: use
 190     them at your own risk. If you are having a problem with the plugin,
 191     please consult the plugin author before asking for help here (we'll
 192     be more than happy to help, but it might be a problem with the
 193     plugin rather than HTML Purifier.)
 194 </p>
 195
 196 <blockquote class="fancy">
 197 <div class="quote">
 198     This plugin is on top of my favorite list[.] I am going to heavily
 199     depend on it since my clients insist on having <acronym>WYSIWYG</acronym> and I insist on
 200     having pages that validate and are semantically sound.
 201 </div>
 202 <div class="origin">
 203     &mdash; David Molliere, <em>MODx Marketing &amp; Design Team</em>
 204 </div>
 205 </blockquote>
 206
 207 <p>Plugins for other major applications gladly accepted!</p>
 208
 209
 210 <h2 id="Users">Users</h2>
 211
 212 <p>Here are some open-source applications that use HTML Purifier:</p>
 213
 214 <table>
 215     <tr><td><a href="http://www.aliro.org/">Aliro</a></td><td><a href="http://aliro-svn.cvsdude.com/aliro/trunk/extclasses/HTMLPurifier.php">3.1.0</a></td></tr>
 216     <tr><td><a href="http://code.google.com/p/jibberbook/">Jibberbook</a></td><td><a href="http://jibberbook.googlecode.com/svn/trunk/source/htmlpurifier/HTMLPurifier.standalone.php">3.1.0</a></td></tr>
 217     <tr><td><a href="http://brilaps.com/index.php?content=mia">Mia</a></td><td><a href="http://code.google.com/p/mia-chat/source/browse/trunk/mia_0_8_x/includes/htmlpurifier/HTMLPurifier.php">3.1.0</a></td></tr>
 218     <tr><td><a href="http://kohanaphp.com/home.html">Kohana</a></td><td><a href="http://trac.kohanaphp.com/browser/trunk/system/vendor">3.1.0</a></td></tr>
 219     <tr><td><a href="http://www.midgard-project.org/">Midgard</a></td><td>via PEAR</td></tr>
 220     <tr><td><a href="http://www.bitweaver.org/">BitWeaver</a></td><td><a href="http://www.bitweaver.org/wiki/HTMLPurifier">via PEAR</a>, see <a href="http://bitweaver.cvs.sourceforge.net/bitweaver/_bit_install/install_checks.php?view=markup">install_checks.php</a></td></tr>
 221     <tr><td><a href="http://code.google.com/p/project-babel/issues/entry">Project Babel</a></td><td>via PEAR and Midgard</td></tr>
 222     <tr><td><a href="http://code.google.com/p/php-atompub-server/">PHP Atompub Server</a></td><td><a href="http://code.google.com/p/php-atompub-server/wiki/SanitizingInput">via download</a></td></tr>
 223 </table>
 224
 225 <p>If I've forgotten anyone, drop me a line with a link to both
 226 your application and the use of HTML Purifier in your code repository,
 227 and I'll add your application to this list.</p>
 228
 229 <h3>Hall of Limbo: PHP4</h3>
 230
 231 <p>The following applications are using HTML Purifier 2.1, for PHP4 compatibility.
 232 While this is fine, I would much rather they go PHP5!</p>
 233
 234 <table>
 235     <tr><td>There are currently no applications using an up-to-date version of HTML Purifier 2.1.</td></tr>
 236 </table>
 237
 238
 239 <h3>Hall of the Past</h3>
 240
 241 <p>The following projects package HTML Purifier with their software, but are
 242 not up-to-date. They are putting their userbase at risk of security attacks
 243 by not keeping HTML Purifier updated. If you're a user or developer for these projects, please
 244 raise your voice and help to get them fixed!</p>
 245
 246 <table>
 247     <tr><td><!--<a href="http://code.google.com/p/wpids/">-->WPIDS<!--</a>--></td><td><a href="http://code.google.com/p/wpids/source/browse/trunk/htmlpurifier/HTMLPurifier.php">3.0.0</a></td></tr>
 248     <tr><td><!--<a href="http://noserub.com/">-->NoseRub<!--</a>--></td><td><a href="http://code.google.com/p/noserub/source/browse/trunk/vendors/htmlpurifier/HTMLPurifier.php">3.0.0</a></td></tr>
 249     <tr><td><!--<a href="http://getlilina.org/">-->Lilina News Aggregator<!--</a>--></td><td><a href="http://lilina.googlecode.com/svn/trunk/lilina/inc/contrib/HTMLPurifier.standalone.php">2.1.3</a></td></tr>
 250     <tr><td><!--<a href="http://info.tikiwiki.org/tiki-index.php">-->TikiWiki<!--</a>--></td><td><a href="http://tikiwiki.svn.sourceforge.net/viewvc/tikiwiki/branches/1.10/lib/HTMLPurifier.php?view=markup">2.1.3</a></td></tr>
 251     <tr><td><!--<a href="http://code.google.com/p/xoopsbrasil/">-->XOOPS Cube BRASIL<!--</a>--></td><td><a href="http://code.google.com/p/xoopsbrasil/source/browse/xoops_trust_path/PEAR/HTMLPurifier.php">2.1.3</a></td></tr>
 252     <tr><td>Lichen Webmail</td><td><a href="http://trac.lichen-mail.org/browser/trunk/libs/HTMLPurifier.php">2.0.1</a>, see <a href="https://trac.lichen-mail.org/ticket/79">ticket #79</a></td></tr>
 253     <tr><td>PHProjekt</td><td><a href="http://thinkforge.org/plugins/scmcvs/cvsweb.php/phprojekt50/lib/html/library/HTMLPurifier.php?rev=HEAD;content-type=text%2Fplain;cvsroot=phprojekt5">1.6.0</a></td></tr>
 254     <tr><td>XDForum</td><td><a href="http://xdforum.svn.sourceforge.net/viewvc/xdforum/trunk/xdforum/includes/htmlpurifier/library/HTMLPurifier.php?view=markup">1.3.2</a></td></tr>
 255 </table>
 256
 257 <h2 id="Propaganda">Spread the Word!</h2>
 258
 259 <p>Help spread awareness about HTML Purifier by:</p>
 260
 261 <ul>
 262 <li><a
 263 href="http://del.icio.us/post?v=4&amp;noui&amp;url=http://htmlpurifier.org/&amp;title=HTML%20Purifier%20-%20Filter%20your%20HTML%20the%20standards-compliant%20way!"
 264 id="delicious">Bookmarking this website</a> on your <strong>del.icio.us</strong> account, and/or</li>
 265 <li>
 266     <div>Including this little <strong>label</strong> on your website:
 267     <a href="http://htmlpurifier.org/"><img
 268     src="live/art/powered.png"
 269     alt="Powered by HTML Purifier" border="0" /></a>, with this code:
 270     </div>
 271     <pre class="long">&lt;a href=&quot;http://htmlpurifier.org/&quot;&gt;&lt;img
 272 src=&quot;http://htmlpurifier.org/live/art/powered.png&quot;
 273 alt=&quot;Powered by HTML Purifier&quot; border=&quot;0&quot; /&gt;&lt;/a&gt;</pre>
 274 </li>
 275 </ul>
 276
 277 </div>
 278
 279 </body>
 280 </html>