I am currently working on a project that requires users to input text that may or may not be formatted (if it helps, just think of it as a Stack Exchange clone, even though that's not quite accurate). Instead of opting for some sort of BB Code or other markup language to allow users to format their text, I figure it'd probably less stressful for the user to just use a subset of HTML. My users are all generally pretty experienced computer users, so I don't expect that to be much of an issue.
My plan is to have a whitelist of tags and attributes. Anything that doesn't match the whitelist will be removed. I figure that as long as I don't accidentally allow a dangerous attribute or element and I implement the code well, there won't be any problems.
I think I generally implemented the code well, but my knowledge of security issues is shaky at best, hence why I'm posting the code here.
I'm not too worried about SQL injection so my biggest concern is XSS and I guess any forms of injection that I'm not familiar with.
Changes that I'll be making:
- Remove the style attribute from the whitelist (now I need a way for users to bold/italicize their text, I'll probably allow
<i>, I guess)
- Check image src's against a whitelist
- Remove the
nl2brstuff and use
white-space: pre-wrapin my CSS instead