1 <!DOCTYPE html PUBLIC
"-//W3C//DTD XHTML 1.0 Transitional//EN"
2 "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
3 <html xmlns=
"http://www.w3.org/1999/xhtml" xml:
lang=
"en" lang=
"en">
5 <title>Comparison - HTML Purifier
</title>
6 <meta http-equiv=
"Content-Type" content=
"text/html; charset=UTF-8" />
7 <meta name=
"keywords" content=
"HTMLPurifier, HTML Purifier, HTML, filter, filtering, HTML_Safe, PEAR, comparison, kses, striptags, SafeHTMLChecker" />
8 <meta name=
"author" content=
"Edward Z. Yang" />
9 <link rel=
"icon" href=
"./favicon.ico" type=
"image/x-icon" />
10 <link rel=
"shortcut icon" href=
"./favicon.ico" type=
"image/x-icon" />
11 <link rel=
"stylesheet" href=
"./style.css" type=
"text/css" />
12 <!--[if lt IE 7.]><script defer="defer" type="text/javascript" src="./pngfix.js"></script><![endif]-->
13 <script defer=
"defer" type=
"text/javascript" src=
"./toc-gen.js"></script>
17 <img src=
"./logo.png" id=
"logo" alt=
"HTML Purifier" />
19 <h1 id=
"title">Comparison
</h1>
20 <div id=
"header"><a href=
"./"><span class=
"html">HTML
</span> <span class=
"purifier">Purifier
</span></a></div>
24 <p class=
"lead">With the advent of
25 <a href=
"http://en.wikipedia.org/wiki/Web_2.0">Web
2.0</a>, the end user has
26 gone from passive consumer to active producer of content on the World Wide
27 Web.
<a href=
"http://en.wikipedia.org/wiki/Wiki">Wikis
</a>,
28 <a href=
"http://en.wikipedia.org/wiki/Social_software">Social Software
</a> and
29 <a href=
"http://en.wikipedia.org/wiki/Blog">Blogs
</a> all
30 put the user in control.
</p>
32 <p>Give the user too much control, however, and you set yourself up
33 for
<a href=
"http://en.wikipedia.org/wiki/Cross-site_scripting"><acronym
34 title=
"Cross Site Scripting">XSS
</acronym></a> attacks. For this reason,
35 <acronym title=
"HyperText Markup Language">HTML
</acronym>'s flexibility
36 has proven to be both a blessing and a curse, and the software that processes
37 it must strike a fine balance between security and usability. How do
38 we prevent users from injecting JavaScript or inserting malformed
39 <acronym title=
"HyperText Markup Language">HTML
</acronym> while allowing
40 a rich syntax of tags, attributes and
<acronym
41 title=
"Cascading Style Sheets">CSS
</acronym>? How do we put
42 <acronym title=
"HyperText Markup Language">HTML
</acronym> inside
43 <acronym title=
"Really Simple Syndication">RSS
</acronym> feed without worrying
44 about sloppy coding messing up
<acronym
45 title=
"eXtensible Markup Language">XML
</acronym> parsing?
46 Almost every
<acronym title=
"PHP: Hypertext Preprocessor">PHP
</acronym>
47 developer has come across this problem before, and many have tried
48 (albeit unsuccessfully) to solve this problem. We will analyze existing
49 libraries to demonstrate how they are ineffective and, of course,
50 how HTML Purifier solves all our problems and achieves world peace.
</p>
52 <p>I will take no quarter and pull no punches: as of the time of writing,
53 no other library comes even
<em>close
</em> to solving the problem effectively
54 for richly formatted documents. However, it's important to note HTML
55 Purifier's mission: to filter
<em>richly formatted
</em> documents.
56 There are cases in which HTML Purifier is overkill, in such situations,
57 use the tool best suited for the job.
</p>
59 <div id=
"toc"><noscript>
60 <p><strong>Notice:
</strong> There is a Table of Contents, but it is dynamically
61 generated. Please enable JavaScript to see it.
</p>
64 <h2 id=
"Summary">Summary
</h2>
66 <p>A table summarizing the differences for the impatient.
</p>
68 <div class=
"wide-table">
69 <table cellspacing=
"0">
82 <th>XSS
safe
</th>
83 <th>Standards
safe
</th>
94 <td class=
"impl-almostyes">Yes (user)
</td>
95 <td class=
"impl-partial">Buggy
</td>
96 <td class=
"impl-no">No
</td>
97 <td class=
"impl-no">No
</td>
98 <td class=
"impl-no">No
</td>
99 <td class=
"impl-no">No
</td>
100 <td class=
"impl-no">No
</td>
104 <td>PHP Input Filter
</td>
108 <td class=
"impl-almostyes">Yes (user)
</td>
109 <td class=
"impl-yes">Yes
</td>
110 <td class=
"impl-no">No
</td>
111 <td class=
"impl-no">No
</td>
112 <td class=
"impl-partial">Partial
</td>
113 <td class=
"impl-almostyes">Probably
</td>
114 <td class=
"impl-no">No
</td>
122 <td class=
"impl-no">Mostly No
</td>
123 <td class=
"impl-yes">Yes
</td>
124 <td class=
"impl-yes">Yes
</td>
125 <td class=
"impl-no">No
</td>
126 <td class=
"impl-partial">Partial
</td>
127 <td class=
"impl-almostyes">Probably
</td>
128 <td class=
"impl-no">No
</td>
136 <td class=
"impl-almostyes">Yes (user)
</td>
137 <td class=
"impl-yes">Yes
</td>
138 <td class=
"impl-no">No
</td>
139 <td class=
"impl-no">No
</td>
140 <td class=
"impl-partial">Partial
</td>
141 <td class=
"impl-almostyes">Probably
</td>
142 <td class=
"impl-no">No
</td>
146 <td>Safe HTML Checker
</td>
150 <td class=
"impl-almostyes">Yes (bare)
</td>
151 <td class=
"impl-yes">Yes
</td>
152 <td class=
"impl-yes">Yes
</td>
153 <td class=
"impl-almostyes">Almost
</td>
154 <td class=
"impl-partial">Partial
</td>
155 <td class=
"impl-yes">Yes
</td>
156 <td class=
"impl-almostyes">Almost
</td>
160 <td>HTML Purifier
</td>
164 <td class=
"impl-yes">Yes
</td>
165 <td class=
"impl-yes">Yes
</td>
166 <td class=
"impl-yes">Yes
</td>
167 <td class=
"impl-yes">Yes
</td>
168 <td class=
"impl-yes">Yes
</td>
169 <td class=
"impl-yes">Yes
</td>
170 <td class=
"impl-yes">Yes
</td>
178 <h2 id=
"AltMarkup">Look Ma, No HTML!
</h2>
180 <blockquote class=
"quote">
181 <div>A clever person solves a problem.
</div>
182 <div>A wise person avoids it.
</div>
183 <div class=
"attribution">Einstein
</div>
186 <p class=
"lead">While libraries of this type really shouldn't be
187 considered
<acronym title=
"HyperText Markup Language">HTML
</acronym> filters,
188 they are the number one method of taking user input and processing it into
189 something more than plain old text. These libraries forgo
190 <acronym title=
"HyperText Markup Language">HTML
</acronym> and define their
191 own markup syntax.
<a href=
"http://en.wikipedia.org/wiki/BBCode">BBCode
</a>,
192 <a href=
"http://en.wikipedia.org/wiki/Wikitext">Wikitext
</a>,
193 <a href=
"http://daringfireball.net/projects/markdown/">Markdown
</a> and
194 <a href=
"http://textism.com/tools/textile/">Textile
</a> are all examples of
195 such markup languages (although it should be noted that
196 Wikitext and Markdown can allow
197 <acronym title=
"HyperText Markup Language">HTML
</acronym> within them).
198 The benefits (to those who use it, anyway) are clear: simplicity and
202 <table cellspacing=
"0">
205 <th>Markup language
</th>
212 <td><tt>[b]B[/b] [i]i[/i] [url = http://www.example.com/]link[/url].
</tt></td>
215 <th>Wikitext
<sup>1</sup></th>
216 <td><tt>'''B''' ''i'' [http://www.example.com/ link]
</tt></td>
219 <th>Markdown
<sup>2</sup></th>
220 <td><tt>**B** *i* [link](http://www.example.com/)
</tt></td>
224 <td><tt>*B* _i_
"link
":http://www.example.com/
</tt></td>
228 <td><tt><b
>B
</b
> <i
>i
</i
> <a href=
"http://www.example.com/
">link
</a
></tt></td>
232 <td><b>B
</b> <i>i
</i> <a href=
"http://www.example.com/">link
</a></td>
238 <li>Wikitext shown is modeled after
<a
239 href=
"http://www.mediawiki.org/wiki/MediaWiki">MediaWiki
</a> style.
240 There are many variants of Wikitext currently extant.
</li>
241 <li>Strictly speaking, the Markdown syntax is not equivalent: bold text
242 is expressed as
<code><strong
></code> and italicized text is
243 expressed as
<code><em
></code>. Most browser default stylesheets,
244 however, map those two semantic tags to the associated styling, so
245 many users assume that it really is italics (and use it improperly for,
246 say, book titles.)
</li>
249 <h3 id=
"AltMarkup:Simplicity">Simplicity
</h3>
251 <p class=
"lead"><acronym title=
"HyperText Markup Language">HTML
</acronym>
252 source code is often criticized for being difficult to read. For example,
264 <li
>Item
1</li
>
265 <li
>Item
2</li
>
269 <p>Which would you prefer to edit? The answer seems obvious, but be careful
270 not to fall into the fallacy of
<a
271 href=
"http://en.wikipedia.org/wiki/False_dilemma">false dilemma
</a>.
272 There
<em>is
</em> a third choice: the
273 <acronym title=
"What You See Is What You Get">WYSIWYG
</acronym> (rich text)
274 editor, which blows earlier choices out of the water in terms
277 <p>Note that rich text editors and alternate markup syntaxes are not
278 mutually exclusive, but, when push comes to shove, it's easier
279 implement this sort of editor on top of
<acronym
280 title=
"HyperText Markup Language">HTML
</acronym> than some obscure
281 markup language. And in the cases when it is done, you usually end up with
282 a live preview, not a true rich text editor.
</p>
284 <blockquote class=
"digression">
285 <p>"Now just wait a second,
" you may be saying,
286 "<acronym title=
"What You See Is What You Get">WYSIWYG
</acronym>
287 editors aren't all that great.
" There are many good arguments
288 against these editors, and
<a
289 href=
"http://www.ideography.co.uk/library/seybold/WYSIWYG.html">intelligent
290 people have written essays
</a> devoted to
291 criticizing
<acronym title=
"What You See Is What You Get">WYSIWYG
</acronym>.
292 In addition to the usual arguments against said editors, the web poses
293 another limitation: no JavaScript means no
294 editor, and no editor means... (gasp) manually typing in code.
</p>
296 <p>Even the most dogmatic purist, however, should recognize that for all
297 its faults, prospective clients
<em>really
</em> want rich text editors.
298 There are steps you can take to mitigate the associated drawbacks of
301 <p>It is often asserted that
302 <acronym title=
"What You See Is What You Get">WYSIWYG
</acronym> editors
303 <em>encourage excessive presentational markup
</em>. As it turns out,
304 this is the case with any markup language that allows the smallest
305 iota of presentational tags, be it
<tt><font
></tt> or
306 <tt>[color=red]
</tt>.
307 A good way to reduce this trouble is to simply eliminate the
308 dialogue boxes that allow users to change colors or fonts (which
309 usually have no legitimate use) and adopt a
310 <acronym title=
"What You See Is What You Mean">WYSIWYM
</acronym> scheme,
311 allowing users to select contextually correct formatting styles
312 for segments of text.
</p>
315 <p>Simplicity is also a double-edged sword. The moment any remotely
316 complex markup is needed, these lightweight markup languages fail to
317 produce. Sure you can make '''this text bold''' with Wikitext, but that
318 infobox all
"rendered nicely in aqua blue
" will require a gaggle of
319 <div
>s and
<acronym title=
"Cascading Style Sheets">CSS
</acronym>.
320 These languages face the same troubles as regular
<acronym
321 title=
"HyperText Markup Language">HTML
</acronym> filters in that their
322 whitelist is too restrictive (besides the fact that their table markup
323 is extraordinarily complex).
</p>
325 <h3 id=
"AltMarkup:Security">Security
</h3>
327 <p class=
"lead">BBCode can be boiled down to a
"wanna-be
" version of
328 <acronym title=
"HyperText Markup Language">HTML
</acronym>. I mean, replacing
329 the angled brackets with square brackets and omitting the occasional parameter
330 name? How much more un-original can you get? Somehow, I don't think BBCode
331 was meant to readable.
<a
332 href=
"http://en.wikipedia.org/wiki/BBCode">Wikipedia
</a> agrees:
</p>
335 BBCode was devised and put to use in order to provide a safer, easier
336 and more limited way of allowing users to format their messages.
337 Previously, many message boards allowed the users to include HTML,
338 which could be used to break/imitate parts of the layout, or run
339 JavaScript. Some implementations of BBCode have suffered problems related
340 to the way they translate the BBCode into HTML, which could negate the
341 security that was intended to be given by BBCode.
344 <p>Or, put more simply:
</p>
347 BBCode came to life when developers where too lazy to parse HTML correctly
348 and decided to invent their own markup language. As with all products of
349 laziness, the result is completely inconsistent, unstandardized, and
353 <p>Well, developers, the whole point of HTML Purifier is that I do the
354 work so you can just execute the ridiculously simple
355 <tt>$purifier-
>purify($html)
</tt> call and go on to do, well, whatever
356 you developers do.
<tt>:-P
</tt></p>
358 <h3 id=
"AltMarkup:Conclusion">Conclusion
</h3>
360 <p>These alternative markup languages have their shiny points, and HTML
361 Purifier is not meant to replace them. However, a major reason for
362 their existence has been called into question. Why are
<em>you
</em>
363 using these languages?
</p>
365 <h2 id=
"Tidy">HTML Tidy
</h2>
367 <p class=
"lead">Dave Raggett's
368 <a href=
"http://www.w3.org/People/Raggett/tidy/">HTML Tidy
</a> is a program;
369 neat enough, at least, to make it into PHP as a
370 <a href=
"http://us2.php.net/manual/en/ref.tidy.php">PECL extension.
</a>
371 The premise is simple, the execution effective. Tidy is, in short, a great
374 <p>It is not, however, a filter. I am often surprised when people ask
375 me,
"What about Tidy?
" There's nothing against Tidy: Tidy tackles
376 a different problem set. Let's see what
<tt>man tidy
</tt> has to say:
</p>
378 <blockquote cite=
"http://tidy.sourceforge.net/docs/tidy_man.html">
379 Tidy reads HTML, XHTML and XML files and writes cleaned up markup. For
380 HTML variants, it detects and corrects many common coding errors and
381 strives to produce visually equivalent markup that is both W3C compliant
382 and works on most browsers. A common use of Tidy is to convert plain HTML
386 <p>Hmm... why do I not see the words
"filter
" or
"<acronym
387 title=
"Cross Site Scripting">XSS
</acronym>" in here? Perhaps it's
388 because Tidy accepts
<em>any
</em> valid
389 <acronym title=
"HyperText Markup Language">HTML
</acronym>. Including
390 <tt>script
</tt> tags. Which leads us to our second part: Tidy parses
391 <em>documents
</em>, not document
<em>fragments
</em>.
</p>
393 <p>This is not to say that I haven't seen Tidy be used in this sort of
394 fashion. MediaWiki, for instance, uses Tidy to cleanup the final HTML
395 output before shuttling it off to the browser. The developers, nevertheless,
396 agree that this is only a band-aid solution, and that the real way
397 to fix it is to fix the parser. Tidy's great, but in terms of security,
398 it's unsuited for untrusted sources.
</p>
400 <h2 id=
"Preface">Preface
</h2>
402 <p>I've ordered my analyses according to how bad a library is. The worst
403 is first, and then we move up the spectrum. I will point out the most
404 flagrant problems with the libraries, but note that I will omit more
405 advanced vulnerabilities: if you can't catch an
<tt>onmouseover
</tt>
406 attribute, I really shouldn't reprimand you for letting non-SGML code
407 points through. The ideal solution, however, must do all these things.
</p>
409 <h2 id=
"striptags">striptags()
</h2>
411 <table class=
"summary">
412 <tr><th>Whitelist
</th> <td>Yes, user-specified
</td></tr>
413 <tr><th>Removes foreign tags
</th> <td>Buggy
</td></tr>
414 <tr><th>Makes well-formed
</th> <td>No
</td></tr>
415 <tr><th>Fixes nesting
</th> <td>No
</td></tr>
416 <tr><th>Validates attributes
</th> <td>No
</td></tr>
419 <p class=
"lead">The PHP function
420 <a href=
"http://php.net/manual/en/function.strip-tags.php">striptags()
</a> is
421 the classic solution for attempting to clean up
422 <acronym title=
"HyperText Markup Language">HTML
</acronym>. It
423 is also the
<em>worst
</em> solution, and should be avoided like the plague.
424 The fact that it doesn't validate attributes at all means that anyone can
425 insert an
<tt>onmouseover='xss();'
</tt> and exploit your application. While
426 this can be bandaided with a series of regular expressions that strip out
427 on[event] (you're still vulnerable to
<acronym
428 title=
"Cross Site Scripting">XSS
</acronym> and at the mercy of
429 quirky browser behavior), striptags() is fundamentally flawed and should not be
433 <h2 id=
"Input_Filter">PHP Input Filter
</h2>
435 <p class=
"lead">Though its title may not imply it,
436 <a href=
"http://cyberai.com/inputfilter/">PHP Input Filter
</a>
437 is a souped up version of striptags() with the ability to inspect
438 attributes. (Don't mind the hastily tacked on query escaping function).
</p>
440 <table class=
"summary">
441 <tr><th>Version
</th> <td>1.2.2</td></tr>
442 <tr><th>Last update
</th> <td>2005-
10-
05</td></tr>
443 <tr><th>License
</th> <td>GPL
</td></tr>
444 <tr><th>Whitelist
</th> <td>Yes, user defined
</td></tr>
445 <tr><th>Removes foreign tags
</th> <td>Yes
</td></tr>
446 <tr><th>Makes well-formed
</th> <td>No
</td></tr>
447 <tr><th>Fixes nesting
</th> <td>No
</td></tr>
448 <tr><th>Validates attributes
</th> <td>Partial
</td></tr>
449 <tr><th>XSS safe
</th> <td>Probably
</td></tr>
450 <tr><th>Standards safe
</th> <td>No
</td></tr>
453 <p>PHP Input Filter implements an
454 <acronym title=
"HyperText Markup Language">HTML
</acronym> parser, and
455 performs very basic checks on whether or not tags and attributes have
456 been defined in the whitelist as well as some smarter
<acronym
457 title=
"Cross Site Scripting">XSS
</acronym> checks. It is left up to
458 the user to define what they'll permit.
</p>
460 <p>With absolutely no checking of well-formedness, it is trivially easy
461 to trick the filter into leaving unclosed tags lying around. While
462 standards-compliance can be viewed by some as a
"nice feature
",
463 basic sanity checks like this must be implemented.
</p>
465 <p>More troubles: Woe to
466 any user that allows the
<tt>style
</tt> attribute: you can't simply
468 title=
"Cascading Style Sheets">CSS
</acronym> through and expect your
469 layout not to be badly mutilated. To top things off,
470 the filter doesn't even preserve data properly: attributes have all
471 spaces stripped out of them. Stay away, stay away!
</p>
473 <h2 id=
"HTML_Safe">HTML_Safe/SafeHTML
</h2>
475 <p class=
"lead"><a href=
"http://pear.php.net/package/HTML_Safe">HTML_Safe
</a> is
476 <acronym title=
"PHP Application and Extension Repository">PEAR
</acronym>'s
477 <acronym title=
"HyperText Markup Language">HTML
</acronym>
479 It should be noted that this is the same library as
480 <a href=
"http://pixel-apes.com/safehtml/">SafeHTML
</a>, though with different
481 branding (and a different version number).
</p>
483 <table class=
"summary">
484 <tr><th>Version
</th> <td>0.9.9beta
</td></tr>
485 <tr><th>Last update
</th> <td>2005-
12-
21</td></tr>
486 <tr><th>License
</th> <td>BSD (
3 clause)
</td></tr>
487 <tr><th>Whitelist
</th> <td>Mostly No
</td></tr>
488 <tr><th>Removes foreign tags
</th> <td>Yes
</td></tr>
489 <tr><th>Makes well-formed
</th> <td>Yes
</td></tr>
490 <tr><th>Fixes nesting
</th> <td>No
</td></tr>
491 <tr><th>Validates attributes
</th> <td>Partial
</td></tr>
492 <tr><th>XSS safe
</th> <td>Probably
</td></tr>
493 <tr><th>Standards safe
</th> <td>No
</td></tr>
496 <p>HTML_Safe's mechanism of action involves parsing
497 <acronym title=
"HyperText Markup Language">HTML
</acronym> with a
498 <acronym title=
"Simple API for XML">SAX
</acronym> parser and performing
499 validation and filtering as the handlers are called. HTML_Safe does a lot
500 of things right, which is why I say it
<em>probably
</em> isn't vulnerable
501 to
<acronym title=
"Cross Site Scripting">XSS
</acronym>, but its approach
502 is fundamentally flawed: blacklists.
</p>
504 <p>This library maintains arrays of dangerous tags, attributes and
505 <acronym title=
"Cascading Style Sheets">CSS
</acronym> properties. (It also
506 has a blacklist of dangerous
<acronym
507 title=
"Uniform Resource Identifier">URI
</acronym> protocols, but this is
508 intelligently disabled by default in favor of a protocol whitelist.)
509 What this means is that HTML_Safe has no qualms of accepting input
510 like
<tt><foobar
> Bang
</foobar
></tt>. Anything goes except
511 the tags in those arrays. Scratch standards-compliance (and that was
512 without even considering proper nesting).
</p>
514 <p>For now, HTML_Safe might be safe from
515 <acronym title=
"Cross Site Scripting">XSS
</acronym>.
516 In the future, however, one of the infinitely many tags that HTML_Safe lets
517 through might just possibly be given special functionality by browser vendors.
518 And it might just turn out that this can be exploited.
<em>Any
</em> blacklist
519 solution puts you at a perpetual arms race against crackers who are constantly
520 discovering new and inventive ways to abuse tags and attributes that you
521 didn't blacklist.
</p>
523 <h2 id=
"kses">kses
</h2>
525 <p class=
"lead"><a href=
"http://sourceforge.net/projects/kses/">kses
</a> appears to
526 be the de-facto solution for cleaning
527 <acronym title=
"HyperText Markup Language">HTML
</acronym>, having found
528 its way into applications such as
<a href=
"http://wordpress.org/">WordPress
</a>
529 and being the number one search result for
"php html filter
".
</p>
531 <table class=
"summary">
532 <tr><th>Version
</th> <td>0.2.2</td></tr>
533 <tr><th>Last update
</th> <td>2005-
02-
06</td></tr>
534 <tr><th>License
</th> <td>GPL
</td></tr>
535 <tr><th>Whitelist
</th> <td>Yes, user defined
</td></tr>
536 <tr><th>Removes foreign tags
</th> <td>Yes
</td></tr>
537 <tr><th>Makes well-formed
</th> <td>No
</td></tr>
538 <tr><th>Fixes nesting
</th> <td>No
</td></tr>
539 <tr><th>Validates attributes
</th> <td>Partial
</td></tr>
540 <tr><th>XSS safe
</th> <td>Probably
</td></tr>
541 <tr><th>Standards safe
</th> <td>No
</td></tr>
544 <p>To be truthful, I didn't do as comprehensive a code survey for kses
545 as I did for some of the other libraries. Out of
546 all the classes I've reviewed so far, kses was definitely the hardest to
549 <p>kses's modus operandi is splitting up html with a monster regexp
550 and then validating each section with
<tt>kses_split2()
</tt>. It
551 suffers from the same problems as Input Filter: no well-formedness
552 checks leading to rampant runaway tags (and no standards-compliance).
</p>
554 <p>Its whitelist syntax, however, is the most complex of all these libraries,
555 so I'm going to take some time to argue why this particular implementation
556 is bad. The author of this library was thoughtful enough to provide some
557 basic constraint checks on attributes like maxlen and maxval. Now, barring
558 the fact that there simply aren't enough checks, and the fact that they are
559 all lumped together in one function, we now must wonder whether or not
560 the user will go through the trouble of specifying the maximum length
561 of a title attribute.
</p>
563 <p>I have my opinions about inherent human laziness, but perhaps WordPress's
564 default filterset is the most telling example:
</p>
567 $allowedposttags = array (
568 /* formatted and trimmed */
571 'noshade' =
> array (),
578 <p>Hmm... do I see a blatant lack of attribute constraints? Conclusion:
579 if the user can get away with not doing work, they will! The biggest
580 problem in all these whitelists filters is that they forgot to
<em>supply
</em>
581 the whitelist. The whitelist is just as important as the code that uses
582 the whitelist to filter
583 <acronym title=
"HyperText Markup Language">HTML
</acronym>.
</p>
585 <h2 id=
"Safe_HTML_Checker">Safe HTML Checker
</h2>
588 <a href=
"http://simon.incutio.com/archive/2003/02/23/safeHtmlChecker">Safe
589 HTML Checker
</a> is (to my knowledge) the first attempt to make a filter
590 that also outputs standards-compliant XHTML. It wasn't even released or
591 licensed officially, but we'll let that slide: a
4<sup>th
</sup> place
592 search result must have done something right.
</p>
594 <table class=
"summary">
595 <tr><th>Version
</th> <td>in-house
</td></tr>
596 <tr><th>Last update
</th> <td>2003-
09-
15</td></tr>
597 <tr><th>License
</th> <td>undefined
</td></tr>
598 <tr><th>Whitelist
</th> <td>Yes (bare-bones)
</td></tr>
599 <tr><th>Removes foreign tags
</th> <td>Yes
</td></tr>
600 <tr><th>Makes well-formed
</th> <td>Yes
</td></tr>
601 <tr><th>Fixes nesting
</th> <td>Almost
</td></tr>
602 <tr><th>Validates attributes
</th> <td>Partial
</td></tr>
603 <tr><th>XSS safe
</th> <td>Yes
</td></tr>
604 <tr><th>Standards safe
</th> <td>Almost
</td></tr>
607 <p>Indeed, it is quite a well-written piece of code. It demonstrates
608 knowledge of inline versus block elements, thus almost nearly getting
609 nesting correct (the only exception is an unimplemented omitted SGML
610 exclusion for
<tt><a
></tt> tags, and that's easy to fix).
</p>
612 <p>Unfortunately, part of the reason why it works so well is that it's
613 extremely restrictive. No styling, no tables, very few attributes.
614 Perfectly appropriate for blog comments, but then again, there's always
615 BBCode. This probably means that Safe HTML Checker has a different
616 goal than HTML Purifier.
</p>
618 <p>The
<acronym title=
"eXtensible Markup Language">XML
</acronym> parser
619 is also quite strict. Accidentally missed a
< sign? The parser will
620 complain with the cryptic message:
621 "<acronym title=
"eXtensible HyperText Markup Language">XHTML
</acronym>
622 is not well-formed
".
623 The solution is not as simple as just switching to a more permissive
624 parser: Safe HTML Checker relies on the fact that the parser will have
625 matched up the tags for them.
</p>
627 <h2 id=
"HTMLPurifier">HTML Purifier
</h2>
629 <table class=
"summary">
630 <tr><th>Version
</th> <td>1.2.0</td></tr>
631 <tr><th>Last update
</th> <td>2006-
11-
19</td></tr>
632 <tr><th>License
</th> <td>LGPL
</td></tr>
633 <tr><th>Whitelist
</th> <td>Yes
</td></tr>
634 <tr><th>Removes foreign tags
</th> <td>Yes
</td></tr>
635 <tr><th>Makes well-formed
</th> <td>Yes
</td></tr>
636 <tr><th>Fixes nesting
</th> <td>Yes
</td></tr>
637 <tr><th>Validates attributes
</th> <td>Yes
</td></tr>
638 <tr><th>XSS safe
</th> <td>Yes
</td></tr>
639 <tr><th>Standards safe
</th> <td>Yes
</td></tr>
642 <p class=
"lead">That table should say it all, but I'll add a few more features:
</p>
644 <table class=
"summary">
645 <tr><th>UTF-
8 aware
</th><td>Yes
</td></tr>
646 <tr><th>Object-Oriented
</th><td>Yes
</td></tr>
647 <tr><th>Validates CSS
</th><td>Yes
</td></tr>
648 <tr><th>Tables
</th><td>Yes
</td></tr>
649 <tr><th>PHP
5 aware
</th><td>Yes
</td></tr>
652 <p>This is not to say that HTML Purifier doesn't have problems of its own.
653 It's a fairly nascent library (so there's bound to bugs), it's big
654 (while the others usually fit in one file, this one requires a huge
655 include list), and it's
<a href=
"http://hp.jpsband.org/live/TODO">missing
656 features.
</a> A big thing I would like to see added to this library is
657 multiple levels of filtering: from a super-permissive lint mode
658 to a super-restrictive blog comment mode. But even in its current state,
659 HTML Purifier is far better than the other libraries.
</p>
661 <p>So...
<a href=
"./#Download">what are you waiting for?
</a></p>