index.xhtml

   1 <?xml version="1.0" encoding="UTF-8"?>
   2 <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
   3     "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd" [
   4   <!ENTITY % htmlpurifier.current SYSTEM "current.ent"> %htmlpurifier.current;
   5 ]>
   6 <html xmlns="http://www.w3.org/1999/xhtml"
   7       xmlns:xi="http://www.w3.org/2001/XInclude"
   8       xmlns:xc="urn:xhtml-compiler"
   9       xmlns:rss="urn:xhtml-compiler:RSSGenerator"
  10       xmlns:svn="urn:xhtml-compiler:Subversion"
  11       svn:head-url="$HeadURL$"
  12       svn:revision="$Revision$"
  13       xc:rss-from-svn="yes"
  14       xml:lang="en" lang="en">
  15 <head>
  16 <title>HTML Purifier - Filter your HTML the standards-compliant way!</title>
  17 <xi:include href="common-meta.xml" xpointer="xpointer(/*/node())" />
  18 <link rel="stylesheet" href="index.css" type="text/css" />
  19 <meta name="description"
  20       content="HTML filter that guards against XSS and ensures standards-compliant output." />
  21 <meta name="keywords"
  22       content="HTMLPurifier, HTML Purifier, HTML, filter, filtering, standards, compliant, w3c, XSS, PHP, security, library, open source, LGPL, whitelist" />
  23 <link rel="alternate" type="application/rss+xml"
  24       title="News - HTML Purifier" href="news.rss"
  25       rss:for="news-container"
  26       rss:description="Recent news and updates on HTML Purifier" />
  27 <script defer="defer" type="text/javascript" src="del.icio.us.js" xc:absolute="src"></script>
  28 <script defer="defer" type="text/javascript" src="switch2post.js" xc:absolute="src"></script>
  29 </head>
  30 <body>
  31
  32 <div id="branding">
  33   <h1>
  34     <span class="html">HTML</span>
  35     <span class="purifier">Purifier</span>
  36   </h1>
  37   <blockquote>
  38     <p>
  39       Standards-Compliant HTML Filtering
  40     </p>
  41   </blockquote>
  42 </div>
  43
  44 <div id="navigation">
  45   <h2>Navigation</h2>
  46   <ol>
  47     <li><a href="#News">News</a></li>
  48     <li><a href="#Plugins">Plugins</a></li>
  49     <li><a href="#Demo">Demo</a></li>
  50     <li><strong><a href="#Download">Download</a></strong></li>
  51     <li><a href="#Resources">Resources</a></li>
  52     <li><a href="http://htmlpurifier.org/phorum/">Forum</a></li>
  53     <li><a href="#Contact">Contact</a></li>
  54   </ol>
  55 </div>
  56
  57 <div id="summary">
  58   <h2>Summary</h2>
  59   <div id="summary-safe">
  60     <h3>Safe</h3>
  61     <p>
  62       HTML Purifier defeats XSS with an audited whitelist
  63     </p>
  64   </div>
  65   <div id="summary-clean">
  66     <h3>Clean</h3>
  67     <p>
  68       HTML Purifier ensures standards-compliant output
  69     </p>
  70   </div>
  71   <div id="summary-open">
  72     <h3>Open</h3>
  73     <p>
  74       HTML Purifier is open-source and highly customizable
  75     </p>
  76   </div>
  77 </div>
  78
  79 <div id="intro">
  80   <p><strong>HTML Purifier</strong> is a standards-compliant
  81   <abbr>HTML</abbr> filter library written in
  82   <abbr>PHP</abbr>. HTML Purifier will not only remove all malicious
  83   code (better known as <abbr>XSS</abbr>) with a thoroughly audited,
  84   secure <em>yet</em> permissive <strong><a
  85   href="live/smoketests/printDefinition.php">whitelist</a></strong>,
  86   it will also make sure your documents are
  87   <strong>standards compliant</strong>, something only achievable with a
  88   comprehensive knowledge of <abbr>W3C</abbr>'s specifications.
  89   Tired of using BBCode due to the current landscape of deficient or
  90   insecure <abbr>HTML</abbr> filters? Have a
  91   <strong><acronym>WYSIWYG</acronym></strong> editor but never been able to use it? Looking
  92   for high-quality, standards-compliant, open-source components for that
  93   application you're building? HTML Purifier is for you!</p>
  94
  95   <blockquote class="fancy">
  96   <div class="quote">
  97       I'd just like to say we use HTML Purifier in <a href="http://www.iris.ac/">IRIS</a> for
  98       filtering emails against XSS attacks and we've been more than impressed.
  99   </div>
 100   <div class="origin">&mdash; Chris Corbyn, <em>Senior IRIS Developer</em></div>
 101   </blockquote>
 102
 103   <div id="intro-download">
 104     <h2>Download</h2>
 105     <div id="download-files">
 106       <div id="download-php4" class="dl-box">
 107         <a href="&url.dl.zip;">HTML Purifier &htmlpurifier.current.version;</a>
 108         <span class="file-type">zip</span>
 109       </div>
 110       <div id="download-php5" class="dl-box">
 111         <a href="&url.dl-strict.zip;">HTML Purifier &htmlpurifier.current.version; for PHP 5</a>
 112         <span class="file-type">zip</span>
 113       </div>
 114     </div>
 115     <div id="download-others">
 116       <a href="#Download">Other downloads</a>
 117     </div>
 118   </div>
 119
 120 </div>
 121
 122 <div id="content">
 123
 124 <h2 id="Background">Background</h2>
 125
 126 <p>There are a number of open-source <abbr>HTML</abbr> filtering solutions out
 127 there on the web already
 128 (i.e. <acronym>PEAR</acronym>'s
 129 <a href="http://pear.php.net/package/HTML_Safe">HTML_Safe</a>,
 130 <a href="http://sourceforge.net/projects/kses">kses</a>
 131 and
 132 <a href="http://simon.incutio.com/archive/2003/02/23/safeHtmlChecker">
 133 SafeHtmlChecker.class.php</a>).  What sets HTML Purifier apart from them?
 134 Aren't all of these choices <q>secure</q>?</p>
 135
 136 <p>When it comes to <abbr>HTML</abbr>, <strong>attention to
 137 detail</strong> is key. Does the library demonstrate an in-depth
 138 knowledge of the <abbr>DTD</abbr> that defines
 139 <abbr>HTML</abbr>? Does it perform its filtering off a robust
 140 whitelist rather than a usually out-dated blacklist? Does it go through
 141 the care to check every single attribute in the document for validity?
 142 Does it actually understand tag markup, or pay lip-service with a series
 143 of deficient regexes and str_replace's?</p>
 144
 145 <p>Somewhere along the way, all of HTML Purifier's predecessors fall
 146 flat. HTML_Safe dooms itself to attacks of the future by using a
 147 blacklist. Configurable filters like kses and PHP Input Filter still
 148 cannot validate the contents inside attributes. With all these gaps in
 149 coverage, none of the usual libraries come close to achieving
 150 <strong>standards-compliance</strong>. There is a user-unfriendly,
 151 draconic <abbr>XML</abbr>-based filter called Safe HTML Checker,
 152 but even it forgets that <code>&lt;a&gt;</code> tags cannot be nested
 153 within each other!</p>
 154
 155 <p><strong>Know thy enemy.</strong> Wily hackers have a huge arsenal of
 156 <abbr>XSS</abbr> hidden within the depths of the
 157 <abbr>HTML</abbr> specification. HTML Purifier takes its
 158 effectiveness from the fact that it will decompose the whole document
 159 into tokens, and rigorously process the tokens by removing
 160 non-whitelisted elements, transforming bad practice tags like font into
 161 span, properly checking the nesting of tags and their children and
 162 validating all attributes according to their <abbr>RFC</abbr>s.
 163 HTML Purifier's comprehensive algorithms are complemented by a
 164 <strong>breadth of knowledge</strong>, ensuring that richly formatted
 165 documents pass through unstripped.</p>
 166
 167 <p>To my knowledge, there is nothing else in the wild that offers
 168 protection from <abbr>XSS</abbr>, standards-compliance, and the
 169 corrective processing of poorly formed <abbr>HTML</abbr>
 170 simultaneously. Don't take my word for it though:
 171 do your research. Investigate the other libraries, and decide for
 172 yourself who you would prefer to be the <strong>gatekeeper</strong> to
 173 your system.</p>
 174
 175 <p>To find out more, you can read the
 176 <a href="comparison.html"><strong>Comparison</strong></a>
 177 for a play-by-play analysis of the major filter libraries currently
 178 out there.</p>
 179
 180 <blockquote class="fancy">
 181 <div class="quote">
 182     [Y]ou save my day by allowing me not to write another damned HTML parser.
 183 </div>
 184 <div class="origin">
 185     &mdash; Joseph Halter, <em>Technical Director at Akira Web</em>
 186 </div>
 187 </blockquote>
 188
 189
 190 <h2 id="News">News</h2>
 191
 192 <div id="news-container" class="news">
 193
 194 <div class="item" id="news-1.6.1-released">
 195     <h3 class="title">HTML Purifier 1.6.1 released</h3>
 196     <div class="date">Sun, 05 May 2007 18:14:11 EDT</div>
 197
 198     <div class="body">
 199     <p>The 1.6.1 release, code-named <q>Ach! We missed something! Run!</q>, completes
 200     HTML Purifier's roster of attribute transformations. It also implements
 201     a number of minor features (such as better font transformations, smarter
 202     <abbr>HTML</abbr> parsing, the <abbr>CSS</abbr> property 'white-space'
 203     and <abbr>XHTML</abbr> 1.1), a few bug
 204     fixes (most notably fixed <code>__autoload</code> compatibility issues)
 205     and a ton
 206     of refactoring. 1.6 was for things that absolutely could not wait: this
 207     release, developed in a more leisurely pace, fills in the gaps.</p>
 208
 209     <p>As usual, see <a
 210     href="http://htmlpurifier.org/svnroot/htmlpurifier/tags/1.6.1/NEWS">News</a>
 211     for a complete changelog.</p>
 212     </div>
 213 </div>
 214
 215 <div class="item" id="news-updated-pear">
 216     <h3 class="title">Updated <acronym>PEAR</acronym> package</h3>
 217     <div class="date">Mon, 30 April 2007 17:49:00 EDT</div>
 218
 219     <div class="body">
 220     <p>Recently, a packaging problem with the <acronym>PEAR</acronym>
 221     version of HTML Purifier was pointed out to me by David Schmierer. This
 222     bug would cause HTML Purifier to fail converting <abbr>HTML</abbr> entities such
 223     as &amp;nbsp;. The 1.6.0 release was amended accordingly and re-released.
 224     If you are using the <acronym>PEAR</acronym> release, use:</p>
 225     <pre>pear install --force hp/HTMLPurifier</pre>
 226     <p>...to force an update. Users who manually downloaded the library
 227     and installed do <em>not</em> have to do anything.</p>
 228     </div>
 229 </div>
 230
 231 <div class="item" id="news-relocated">
 232     <h3 class="title">We have relocated</h3>
 233     <div class="date">Sun, 22 April 2007 17:35:59 EDT</div>
 234
 235     <div class="body">
 236     <p>We have relocated from <code>hp.jpsband.org</code> to
 237     <code>htmlpurifier.org</code>. Please update your links and bookmarks
 238     accordingly. Permanent redirects are in place, so old links will
 239     continue to work for a while. However, some pages have changed
 240     locations in the shuffle:</p>
 241     <ul>
 242         <li><code>live/docs/examples/demo.php</code> is now <a href="demo.php">demo.php</a></li>
 243         <li><code>live/docs/</code> is now <a href="docs/">docs/</a></li>
 244         <li><code>v/viewvc.cgi/</code> is now <a href="viewvc.cgi">viewvc.cgi/</a></li>
 245     </ul>
 246     <p>Also, <acronym>PEAR</acronym> users will need to uninstall their
 247     old copy of HTML Purifier, remove the old channel, and then discover
 248     and install at the new domain. This set of commands should do the
 249     trick:</p>
 250 <pre>
 251 pear uninstall hp/HTMLPurifier
 252 pear channel-delete hp.jpsband.org
 253 pear channel-discover htmlpurifier.org
 254 pear install hp/HTMLPurifier
 255 </pre>
 256     <p>Thank you all for your cooperation. If there are any blips, please
 257     report them to the <a
 258     href="http://htmlpurifier.org/phorum/list.php?2">general forums</a> or
 259     my new email address,
 260     <a href="mailto:admin@htmlpurifier.org">admin@htmlpurifier.org</a></p>
 261     </div>
 262 </div>
 263
 264 <div class="item" id="news-svn-and-misc">
 265     <h3 class="title"><abbr>SVN</abbr> viewer and migration</h3>
 266     <div class="date">Tue, 17 April 2007 20:08:11 EDT</div>
 267
 268     <div class="body">
 269     <p><a href="http://htmlpurifier.org/viewvc.cgi/htmlpurifier/trunk/">ViewVC</a>
 270     for viewing our <abbr>SVN</abbr> repository and <abbr>RSS</abbr> changelog feeds for most of our
 271     <abbr>HTML</abbr> pages (for example, the changelog for this page
 272     is at <a href="index.rss">index.rss</a>) were rolled out a few weeks
 273     ago. Feel free to check them out.</p>
 274     <p>Also, I've purchased the <code>htmlpurifier.org</code> domain
 275     so this website will be migrating to that address soon. I'm not in any
 276     particular hurry to get the migration done, but I hope to see some
 277     other changes in the website as well when the move is made. <code>;-)</code></p>
 278     </div>
 279 </div>
 280
 281 <div class="item" id="news-pro-php-podcast">
 282     <h3 class="title">Pro:PHP Podcast mention</h3>
 283     <div class="date">Mon, 09 April 2007 23:23:44 EDT</div>
 284
 285     <div class="body">
 286     <p>I'd like to thank
 287     <a href="http://podcast.phparch.com/main/index.php/main">Pro::PHP</a>
 288     podcast for mentioning HTML Purifier on their
 289     <a href="http://podcast.phparch.com/main/index.php/episodes:20070405">April
 290     5, 2007 show</a>. I've always been a fan of their informative
 291     podcasts, and was delighted to discover that
 292     they had decided to include HTML Purifier on the program list
 293     (even though it was at the very end).
 294     </p>
 295
 296     <p>Against my better judgment, I have a few clarifications I'd like
 297     to make about the podcast:</p>
 298
 299     <ul>
 300         <li>While HTML Purifier can use Tidy, it's completely optional.
 301         Tidy is exploited for pretty-printed <abbr>HTML</abbr>.</li>
 302         <li>We do use the <abbr>XSS</abbr> cheatsheet for
 303         <a href="live/smoketests/xssAttacks.php">testing
 304         the library</a>, but I actually did not know about the cheat-sheet
 305         until the library was well under development.</li>
 306         <li>Yes, the top domain is actually a school band website that
 307         I'm borrowing hosting from. I'm playing around with getting
 308         a dedicated domain at htmlpurifier.org.</li>
 309     </ul>
 310
 311     <p>Once again, thanks for mentioning the library, perhaps someday
 312     I'll do a screencast going through some of HTML Purifier's major
 313     features.</p>
 314     </div>
 315 </div>
 316
 317 <div class="item" id="news-1.6.0-released">
 318     <h3 class="title">HTML Purifier 1.6.0 released</h3>
 319     <div class="date">Sun, 01 April 2007 23:40:59 EDT</div>
 320
 321     <div class="body">
 322     <p>Sorry, no April Fool's joke this year. To compensate, we have
 323     the 1.6.0 <q>Long Overdue</q> release. This version contains support
 324     for a number of deprecated attributes HTML Purifier should have
 325     had from the very beginning, including the name, bgcolor, border,
 326     width and height attributes. The <abbr>CSS</abbr> property 'height',
 327     rel and rev attributes and ID blacklist regexps are also available.
 328     In addition, HTML Purifier will give a friendly error message
 329     when you try to enable an element or attribute that doesn't exist.</p>
 330
 331     <p>All in all, this is a fairly compact release, but it does
 332     address some common requests brought up in the Forums, so I suggest
 333     you upgrade anyway. You can check <a
 334     href="http://htmlpurifier.org/svnroot/htmlpurifier/tags/1.6.0/NEWS">News</a>
 335     for a complete changelog, but there's not much else.</p>
 336     </div>
 337 </div>
 338
 339 </div> <!-- end news-container -->
 340
 341 <h2 id="Plugins">Plugins</h2>
 342
 343 <p>HTML Purifier is a great library to integrate with existing
 344 <abbr>CMS</abbr>es and other applications or <acronym>WYSIWYG</acronym>
 345 editors.  Currently, we have plugins for:</p>
 346
 347 <ul>
 348     <li><a href="http://bart.motd.be/projects/html-purifier-drupal-module">Drupal HTML Purifier Module</a> (beta) by Bart Jansens</li>
 349     <li><a href="http://htmlpurifier.org/svnroot/htmlpurifier/trunk/plugins/modx.txt">MODx Content Management System</a></li>
 350 </ul>
 351
 352 <blockquote class="fancy">
 353 <div class="quote">
 354     This plugin is on top of my favorite list[.] I am going to heavily
 355     depend on it since my clients insist on having <acronym>WYSIWYG</acronym> and I insist on
 356     having pages that validate and are semantically sound.
 357 </div>
 358 <div class="origin">
 359     &mdash; David Molliere, <em>MODx Marketing &amp; Design Team</em>
 360 </div>
 361 </blockquote>
 362
 363 <p>Plugins for other major applications gladly accepted!</p>
 364
 365
 366 <h2 id="Demo">Demo</h2>
 367
 368 <p>Enter your <abbr>HTML</abbr> and see how it will be filtered!</p>
 369 <form id="filter" action="demo.php?post" method="post">
 370     <fieldset>
 371     <legend>HTML Purifier Input</legend>
 372     <textarea name="html" cols="50" rows="10" id="html"></textarea>
 373     <div><abbr>XHTML</abbr> 1.0 Strict output? <input type="checkbox" value="1" name="strict" /></div>
 374     <div>
 375         <input type="submit" value="Submit" name="submit" class="button" />
 376     </div>
 377     </fieldset>
 378 </form>
 379
 380 <p>...or try these sample inputs:</p>
 381
 382 <ul>
 383     <li><a href="demo.php?get&amp;html=%3Cimg+src%3D%22javascript%3Aevil%28%29%3B%22+onload%3D%22evil%28%29%3B%22+%2F%3E">Malicious code removed</a></li>
 384     <li><a href="demo.php?html=%3Cb%3EBold&amp;submit=Submit">Missing end tags fixed</a></li>
 385     <li><a href="demo.php?html=%3Cb%3EInline+%3Cdel%3Econtext+%3Cdiv%3ENo+block+allowed%3C%2Fdiv%3E%3C%2Fdel%3E%3C%2Fb%3E&amp;submit=Submit">Illegal nesting fixed</a></li>
 386     <li><a href="demo.php?html=%3Ccenter%3ECentered%3C%2Fcenter%3E&amp;strict=1&amp;submit=Submit">Deprecated tags converted</a></li>
 387     <li><a href="demo.php?html=%3Cspan+style%3D%22color%3A%23COW%3Bfloat%3Aaround%3Btext-decoration%3Ablink%3B%22%3EText%3C%2Fspan%3E&amp;submit=Submit"><abbr>CSS</abbr> validated</a></li>
 388     <li><a href="demo.php?html=%3Ctable%3E%0D%0A++%3Ccaption%3E%0D%0A++++Cool+table%0D%0A++%3C%2Fcaption%3E%0D%0A++%3Ctfoot%3E%0D%0A++++%3Ctr%3E%0D%0A++++++%3Cth%3EI+can+do+so+much%21%3C%2Fth%3E%0D%0A++++%3C%2Ftr%3E%0D%0A++%3C%2Ftfoot%3E%0D%0A++%3Ctr%3E%0D%0A++++%3Ctd+style%3D%22font-size%3A16pt%3B%0D%0A++++++color%3A%23F00%3Bfont-family%3Asans-serif%3B%0D%0A++++++text-align%3Acenter%3B%22%3EWow%3C%2Ftd%3E%0D%0A++%3C%2Ftr%3E%0D%0A%3C%2Ftable%3E&amp;submit=Submit">Rich formatting preserved</a></li>
 389 </ul>
 390
 391 <h2 id="Download">Download</h2>
 392
 393 <p>The current version is
 394 <strong>&htmlpurifier.current.version;</strong>, released on
 395 &htmlpurifier.current.release-date;.  Pick your distribution:</p>
 396
 397 <ul>
 398 <li><a class="download" href="&url.dl.tar.gz;">HTML Purifier &htmlpurifier.current.version; (.tar.gz)</a> [<a href="&url.dl.tar.gz.sig;">sig</a>]</li>
 399 <li><a class="download" href="&url.dl.zip;">HTML Purifier &htmlpurifier.current.version; (.zip)</a> [<a href="&url.dl.zip.sig;">sig</a>]</li>
 400 <li><a class="download" href="&url.dl-strict.tar.gz;">HTML Purifier &htmlpurifier.current.version; PHP5-strict (.tar.gz)</a> [<a href="&url.dl-strict.tar.gz.sig;">sig</a>]</li>
 401 <li><a class="download" href="&url.dl-strict.zip;">HTML Purifier &htmlpurifier.current.version; PHP5-strict (.zip)</a> [<a href="&url.dl-strict.zip.sig;">sig</a>]</li>
 402 </ul>
 403
 404 <p>The <abbr>PHP</abbr>5-strict version is exactly the same
 405 as the regular version with a few tweaks
 406 to prevent it from complaining with
 407 <a href="http://php.net/manual/en/ref.errorfunc.php#e-strict">E_STRICT</a>
 408 warnings.This library is open-source, licensed under the
 409 <a href="http://www.gnu.org/licenses/lgpl.html"><abbr>LGPL</abbr> v2.1+</a>.</p>
 410
 411 <p>HTML Purifier is also available as a <acronym>PEAR</acronym> package.
 412 You can install it by executing:</p>
 413
 414 <pre class="command">pear channel-discover htmlpurifier.org
 415 pear install hp/HTMLPurifier</pre>
 416
 417 <p>You can also grab the latest developmental code from our Subversion
 418 repository.  Simply execute this command:</p>
 419
 420 <pre class="command long">svn co http://htmlpurifier.org/svnroot/htmlpurifier/trunk ./</pre>
 421
 422 <p>...or <a href="http://htmlpurifier.org/svnroot/htmlpurifier/trunk/">browse
 423 anonymously</a> at that address. Previous releases can be obtained by browsing
 424 the <a href="releases/">release directory</a>
 425 or checking code out of the
 426 <a href="http://htmlpurifier.org/svnroot/htmlpurifier/tags/">tags/
 427 directory</a>. You can also use
 428 <a href="http://htmlpurifier.org/viewvc.cgi/htmlpurifier/trunk/">ViewVC to view the repository</a>.</p>
 429
 430 <p><acronym>SHA-1</acronym> checksums:</p>
 431
 432 <pre class="long">
 433 5589abda6370b58cc2d538c084b79f4994671f9b htmlpurifier-1.6.1-strict.tar.gz
 434 280832537bbc9aa28763ce1141c5f5a60c8c1048 htmlpurifier-1.6.1-strict.zip
 435 fee6d108a50af5949906478c8c557c383f8893fe htmlpurifier-1.6.1.tar.gz
 436 4391ab11fd62c1ff009ffd1089470ad2dcdc0671 htmlpurifier-1.6.1.zip
 437 </pre>
 438
 439 <p>There are also <tt>.sig</tt> files which you can use to cryptographically verify
 440 that the release is from me, Edward Z. Yang.  You can find
 441 my <a href="http://www.thewritingpot.com/gpgpubkey.asc">public key
 442 here (0x869C48DA)</a>.  My key's fingerprint is:
 443 <tt>3FA8 E9A9 7385 B691 A6FC  B3CB A933 BE7D 869C 48DA</tt>.</p>
 444
 445 <p>Verify with these commands:</p>
 446
 447 <pre class="command">gpg --verify <strong>$filename</strong>.sig</pre>
 448
 449 <p>You can be notified of new releases by a low-traffic announce list. Subscribe
 450 here:</p>
 451
 452 <form method="post" action="http://scripts.dreamhost.com/add_list.cgi">
 453    <input type="hidden" name="list" value="admin@htmlpurifier.org" />
 454    <input type="hidden" name="domain" value="htmlpurifier.org" />
 455    <input type="hidden" name="emailit" value="1" />
 456    <div>Name: <input name="name" /> E-mail: <input name="email" /></div>
 457    <div><input type="submit" name="submit" value="Suscribe to Announcement List" />
 458    <input type="submit" name="unsub" value="Unsubscribe" /></div>
 459 </form>
 460
 461 <h2 id="Resources">Resources</h2>
 462 <ul>
 463     <li><strong><a href="docs/">End-User
 464         Documentation</a></strong> &mdash; In-depth documents on how to get
 465         the most out of HTML Purifier.</li>
 466     <li><del>Mantis Bugtracker &mdash; Found a bug? Report
 467         it here!</del> Temporarily disabled</li>
 468     <li><a href="http://htmlpurifier.org/phorum/">Support Forum</a> &mdash; Talk about all things
 469         HTML Purifier.</li>
 470     <li><a href="live/smoketests/printDefinition.php">Print
 471         Definition</a> &mdash; If you want to actually see what HTML Purifier's
 472         filtering rules are, look no further than to this page. You can even
 473         experiment with the configuration to see how things respond to different
 474         directives.</li>
 475     <li><a href="live/smoketests/xssAttacks.php"><abbr>XSS</abbr>
 476         Attacks Smoketest</a> &mdash; Tests how well HTML Purifier fares
 477         against RSnake's famous cheatsheet of <abbr>XSS</abbr> attacks.</li>
 478     <li><a href="live/TODO">Roadmap</a>
 479         &mdash; Subject to lots of delays, but it's a glimpse of the future</li>
 480     <li><a href="live/art/">Artwork</a>
 481         &mdash; Extra media goodies.</li>
 482     <li><a href="live/configdoc/plain.html">Configuration
 483         documentation</a> &mdash; See the <code>INSTALL</code> document on how to
 484         configure your HTML Purifier installation.</li>
 485     <li><a href="http://htmlpurifier.org/doxygen/html/">Doxygen-generated
 486         Documentation</a> &mdash; No class left undocumented!  Cross-referenced
 487         code!  A must-read for any prospective HTML Purifier hacker.
 488         (close by, <a href="http://htmlpurifier.org/phpdoc/">PHPDoc-generated
 489         Documentation.</a>)</li>
 490 </ul>
 491
 492 <h2 id="Propaganda">Spread the Word!</h2>
 493
 494 <p>Help spread awareness about HTML Purifier by:</p>
 495
 496 <ul>
 497 <li><a
 498 href="http://del.icio.us/post?v=4&amp;noui&amp;url=http://htmlpurifier.org/&amp;title=HTML%20Purifier%20-%20Filter%20your%20HTML%20the%20standards-compliant%20way!"
 499 id="delicious">Bookmarking this website</a> on your <strong>del.icio.us</strong> account, and/or</li>
 500 <li>
 501     <div>Including this little <strong>label</strong> on your website:
 502     <a href="http://htmlpurifier.org/"><img
 503     src="live/art/powered.png"
 504     alt="Powered by HTML Purifier" border="0" /></a>, with this code:
 505     </div>
 506     <pre class="long">&lt;a href=&quot;http://htmlpurifier.org/&quot;&gt;&lt;img
 507 src=&quot;http://htmlpurifier.org/live/art/powered.png&quot;
 508 alt=&quot;Powered by HTML Purifier&quot; border=&quot;0&quot; /&gt;&lt;/a&gt;</pre>
 509 </li>
 510 </ul>
 511
 512 <h2 id="Contact">Contact</h2>
 513
 514 <p>You can send me an email at
 515 <a href="mailto:admin@htmlpurifier.org">admin@htmlpurifier.org</a>.
 516 However, I prefer that you use the forums for asking general support
 517 questions (response time will be the same, I promise!)
 518 Any emails I receive will be considered public: if I think a
 519 solution I thought up to help you would be particularly useful to others,
 520 expect it to show up on the website.</p>
 521
 522 </div>
 523
 524 </body>
 525 </html>