index.xhtml

   1 <?xml version="1.0" encoding="UTF-8"?>
   2 <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
   3     "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
   4 <html
   5   xmlns="http://www.w3.org/1999/xhtml"
   6   xmlns:xi="http://www.w3.org/2001/XInclude"
   7   xmlns:xc="urn:xhtml-compiler"
   8   xmlns:svn="urn:xhtml-compiler:Subversion"
   9   svn:head-url="$HeadURL$"
  10   svn:revision="$Revision$"
  11   xc:rss-from-svn="yes"
  12   xml:lang="en">
  13 <head>
  14 <title>HTML Purifier - Filter your HTML the standards-compliant way!</title>
  15 <xi:include href="common-meta.xml" xpointer="xpointer(/*/node())" />
  16 <meta name="description"
  17   content="HTML filter that guards against XSS and ensures standards-compliant output." />
  18 <meta name="keywords"
  19   content="HTMLPurifier, HTML Purifier, HTML, filter, filtering, standards, compliant, w3c, XSS, PHP, security, library, open source, LGPL, whitelist" />
  20 <!-- See news.xhtml for definition -->
  21 <link rel="alternate" type="application/rss+xml" title="News - HTML Purifier" href="news.rss" />
  22 <script defer="defer" type="text/javascript" src="del.icio.us.js" xc:absolute="src"></script>
  23 <!-- OpenID for Edward Z. Yang -->
  24 <link rel="openid.server" href="https://pip.verisignlabs.com/server" />
  25 <link rel="openid.delegate" href="http://edwardzyang.pip.verisignlabs.com/" />
  26 <!-- Google OpenSearch -->
  27 <link rel="search" href="opensearchdescription.xml"
  28   type="application/opensearchdescription+xml"
  29   title="HTML Purifier" />
  30 </head>
  31 <body>
  32
  33 <div id="branding">
  34   <h1>
  35     <span class="html">HTML</span>
  36     <span class="purifier">Purifier</span>
  37   </h1>
  38   <blockquote>
  39     <p>
  40       Standards-Compliant HTML Filtering
  41     </p>
  42   </blockquote>
  43 </div>
  44
  45 <xi:include href="common-navigation.xml" xpointer="xpointer(/*/node())" />
  46
  47 <div id="content">
  48
  49 <div id="summary">
  50   <h2>Summary</h2>
  51   <div id="summary-safe">
  52     <h3>Safe</h3>
  53     <p>
  54       HTML Purifier defeats XSS with an audited whitelist
  55     </p>
  56   </div>
  57   <div id="summary-clean">
  58     <h3>Clean</h3>
  59     <p>
  60       HTML Purifier ensures standards-compliant output
  61     </p>
  62   </div>
  63   <div id="summary-open">
  64     <h3>Open</h3>
  65     <p>
  66       HTML Purifier is open-source and highly customizable
  67     </p>
  68   </div>
  69 </div>
  70
  71 <div id="intro">
  72   <p><strong>HTML Purifier</strong> is a standards-compliant
  73   <abbr>HTML</abbr> filter library written in
  74   <abbr>PHP</abbr>. HTML Purifier will not only remove all malicious
  75   code (better known as <abbr>XSS</abbr>) with a thoroughly audited,
  76   secure <em>yet</em> permissive <strong><a
  77   href="live/smoketests/printDefinition.php">whitelist</a></strong>,
  78   it will also make sure your documents are
  79   <strong>standards compliant</strong>, something only achievable with a
  80   comprehensive knowledge of <abbr>W3C</abbr>'s specifications.
  81   Tired of using BBCode due to the current landscape of deficient or
  82   insecure <abbr>HTML</abbr> filters? Have a
  83   <strong><acronym>WYSIWYG</acronym></strong> editor but never been able to use it? Looking
  84   for high-quality, standards-compliant, open-source components for that
  85   application you're building? HTML Purifier is for you!</p>
  86
  87   <blockquote class="fancy">
  88   <div class="quote">
  89       I'd just like to say we use HTML Purifier in <a href="http://www.iris.ac/">IRIS</a> for
  90       filtering emails against XSS attacks and we've been more than impressed.
  91   </div>
  92   <div class="origin">&mdash; Chris Corbyn, <em>Senior IRIS Developer</em></div>
  93   </blockquote>
  94
  95   <xi:include href="download-box.xml" xpointer="xpointer(/*/node())" />
  96
  97 </div>
  98
  99 <h2 id="Background" class="clear">Background</h2>
 100
 101 <p>There are a number of open-source <abbr>HTML</abbr> filtering solutions out
 102 there on the web already
 103 (i.e. <acronym>PEAR</acronym>'s
 104 <a href="http://pear.php.net/package/HTML_Safe">HTML_Safe</a>,
 105 <a href="http://sourceforge.net/projects/kses">kses</a>
 106 and
 107 <a href="http://simon.incutio.com/archive/2003/02/23/safeHtmlChecker">
 108 SafeHtmlChecker.class.php</a>).  What sets HTML Purifier apart from them?
 109 Aren't all of these choices <q>secure</q>?</p>
 110
 111 <p>When it comes to <abbr>HTML</abbr>, <strong>attention to
 112 detail</strong> is key. Does the library demonstrate an in-depth
 113 knowledge of the <abbr>DTD</abbr> that defines
 114 <abbr>HTML</abbr>? Does it perform its filtering off a robust
 115 whitelist rather than a usually out-dated blacklist? Does it go through
 116 the care to check every single attribute in the document for validity?
 117 Does it actually understand tag markup, or pay lip-service with a series
 118 of deficient regexes and str_replace's?</p>
 119
 120 <p>Somewhere along the way, all of HTML Purifier's predecessors fall
 121 flat. HTML_Safe dooms itself to attacks of the future by using a
 122 blacklist. Configurable filters like kses and PHP Input Filter still
 123 cannot validate the contents inside attributes. With all these gaps in
 124 coverage, none of the usual libraries come close to achieving
 125 <strong>standards-compliance</strong>. There is a user-unfriendly,
 126 draconic <abbr>XML</abbr>-based filter called Safe HTML Checker,
 127 but even it forgets that <code>&lt;a&gt;</code> tags cannot be nested
 128 within each other!</p>
 129
 130 <p><strong>Know thy enemy.</strong> Wily hackers have a huge arsenal of
 131 <abbr>XSS</abbr> hidden within the depths of the
 132 <abbr>HTML</abbr> specification. HTML Purifier takes its
 133 effectiveness from the fact that it will decompose the whole document
 134 into tokens, and rigorously process the tokens by removing
 135 non-whitelisted elements, transforming bad practice tags like font into
 136 span, properly checking the nesting of tags and their children and
 137 validating all attributes according to their <abbr>RFC</abbr>s.
 138 HTML Purifier's comprehensive algorithms are complemented by a
 139 <strong>breadth of knowledge</strong>, ensuring that richly formatted
 140 documents pass through unstripped.</p>
 141
 142 <p>To my knowledge, there is nothing else in the wild that offers
 143 protection from <abbr>XSS</abbr>, standards-compliance, and the
 144 corrective processing of poorly formed <abbr>HTML</abbr>
 145 simultaneously. Don't take my word for it though:
 146 do your research. Investigate the other libraries, and decide for
 147 yourself who you would prefer to be the <strong>gatekeeper</strong> to
 148 your system.</p>
 149
 150 <p>To find out more, you can read the
 151 <a href="comparison.html"><strong>Comparison</strong></a>
 152 for a play-by-play analysis of the major filter libraries currently
 153 out there.</p>
 154
 155 <blockquote class="fancy">
 156 <div class="quote">
 157     [Y]ou save my day by allowing me not to write another damned HTML parser.
 158 </div>
 159 <div class="origin">
 160     &mdash; Joseph Halter, <em>Technical Director at Akira Web</em>
 161 </div>
 162 </blockquote>
 163
 164 <h2 id="Plugins">Plugins</h2>
 165
 166 <p>HTML Purifier is a great library to integrate with existing
 167 <abbr>CMS</abbr>es and other applications or <acronym>WYSIWYG</acronym>
 168 editors.  Currently, we have plugins for these applications:</p>
 169
 170 <ul>
 171     <li><a href="http://www.phorum.org/phorum5/read.php?62,127035">Phorum</a> (in use at our very own forums!)</li>
 172     <li><a href="http://htmlpurifier.org/svnroot/htmlpurifier/trunk/plugins/modx.txt">MODx</a></li>
 173     <li><a href="http://bart.motd.be/projects/html-purifier-drupal-module">Drupal</a> by Bart Jansens</li>
 174     <li><a href="http://urbangiraffe.com/plugins/html-purified/">Wordpress</a> by John Godley</li>
 175     <li><a href="http://extensions.joomla.org/component/option,com_mtree/task,viewlink/link_id,4094/Itemid,35/">Joomla</a> by Double D</li>
 176     <li><a href="http://www.mindloop.be/nieuws/nieuwe-ontwikkelingen/htmlpurifier-and-the-codeigniter-framework">CodeIgniter</a> by Andy Mathijs</li>
 177 </ul>
 178
 179 <p>
 180     <strong>Notice:</strong>
 181     Any plugin provided by a third party has not been vetted by us: use
 182     them at your own risk. If you are having a problem with the plugin,
 183     please consult the plugin author before asking for help here (we'll
 184     be more than happy to help, but it might be a problem with the
 185     plugin rather than HTML Purifier.)
 186 </p>
 187
 188 <blockquote class="fancy">
 189 <div class="quote">
 190     This plugin is on top of my favorite list[.] I am going to heavily
 191     depend on it since my clients insist on having <acronym>WYSIWYG</acronym> and I insist on
 192     having pages that validate and are semantically sound.
 193 </div>
 194 <div class="origin">
 195     &mdash; David Molliere, <em>MODx Marketing &amp; Design Team</em>
 196 </div>
 197 </blockquote>
 198
 199 <p>Plugins for other major applications gladly accepted!</p>
 200
 201
 202 <h2 id="Users">Users</h2>
 203
 204 <p>Here are some open-source applications that use HTML Purifier:</p>
 205
 206 <ul>
 207     <li><a href="http://www.bitweaver.org/">BitWeaver</a> (<a href="http://www.bitweaver.org/wiki/HTMLPurifier">via PEAR</a>, see <a href="http://bitweaver.cvs.sourceforge.net/bitweaver/_bit_install/install_checks.php?view=markup">install_checks.php</a>)</li>
 208     <li><a href="http://www.aliro.org/">Aliro</a> (<a href="http://aliro-svn.cvsdude.com/aliro/trunk/extclasses/HTMLPurifier.php">3.1.0rc1</a>)</li>
 209     <li><a href="http://php-ids.org/">WPIDS</a> (<a href="http://code.google.com/p/wpids/source/browse/trunk/htmlpurifier/HTMLPurifier.php">3.0.0</a>)</li>
 210 </ul>
 211
 212 <p>If I've forgotten anyone, drop me a line with a link to both
 213 your application and the use of HTML Purifier in your code repository,
 214 and I'll add your application to this list.</p>
 215
 216 <h3>Hall of Limbo: PHP4</h3>
 217
 218 <p>The following applications are using HTML Purifier 2.1.3, for PHP4 compatibility.
 219 While this is fine, I would much rather they go PHP5!</p>
 220
 221 <ul>
 222     <li><a href="http://getlilina.org/">Lilina News Aggregator</a> (<a href="http://lilina.googlecode.com/svn/trunk/lilina/inc/contrib/HTMLPurifier.standalone.php">2.1.3</a>)</li>
 223     <li><a href="http://brilaps.com/index.php?content=mia">Mia</a> (<a href="http://code.google.com/p/mia-chat/source/browse/trunk/mia_0_x/includes/htmlpurifier/HTMLPurifier.php">2.1.3</a>)</li>
 224     <li><a href="">TikiWiki</a> (<a href="http://tikiwiki.svn.sourceforge.net/viewvc/tikiwiki/branches/1.10/lib/HTMLPurifier.php?view=markup">2.1.3</a>)</li>
 225 </ul>
 226
 227
 228 <h3>Hall of Shame</h3>
 229
 230 <p>The following users package HTML Purifier with their software, but either are not
 231 up-to-date or are improperly using the cutting-edge development versions in
 232 stable releases. If you're a user or developer for these projects, please
 233 raise your voice and help to get them fixed!</p>
 234
 235 <ul>
 236     <li>PHProjekt (<a href="http://thinkforge.org/plugins/scmcvs/cvsweb.php/phprojekt50/lib/html/library/HTMLPurifier.php?rev=HEAD;content-type=text%2Fplain;cvsroot=phprojekt5">1.6.0</a>)</li>
 237     <li><!--<a href="http://kohanaphp.com/home.html">-->Kohana<!--</a>--> (<a href="http://trac.kohanaphp.com/browser/trunk/system/vendor">trunk</a>, see <a href="http://trac.kohanaphp.com/ticket/603">ticket #603</a>)</li>
 238     <li>Lichen Webmail (<a href="http://trac.lichen-mail.org/browser/trunk/libs/HTMLPurifier.php">2.0.1</a>, see <a href="https://trac.lichen-mail.org/ticket/79">ticket #79</a>)</li>
 239 </ul>
 240
 241 <h2 id="Propaganda">Spread the Word!</h2>
 242
 243 <p>Help spread awareness about HTML Purifier by:</p>
 244
 245 <ul>
 246 <li><a
 247 href="http://del.icio.us/post?v=4&amp;noui&amp;url=http://htmlpurifier.org/&amp;title=HTML%20Purifier%20-%20Filter%20your%20HTML%20the%20standards-compliant%20way!"
 248 id="delicious">Bookmarking this website</a> on your <strong>del.icio.us</strong> account, and/or</li>
 249 <li>
 250     <div>Including this little <strong>label</strong> on your website:
 251     <a href="http://htmlpurifier.org/"><img
 252     src="live/art/powered.png"
 253     alt="Powered by HTML Purifier" border="0" /></a>, with this code:
 254     </div>
 255     <pre class="long">&lt;a href=&quot;http://htmlpurifier.org/&quot;&gt;&lt;img
 256 src=&quot;http://htmlpurifier.org/live/art/powered.png&quot;
 257 alt=&quot;Powered by HTML Purifier&quot; border=&quot;0&quot; /&gt;&lt;/a&gt;</pre>
 258 </li>
 259 </ul>
 260
 261 </div>
 262
 263 </body>
 264 </html>