Regex HTML Sanitisation: Off With Its Head! Defeating Cross-Site
Scripting The solutions which prevent and defend against XSS in
HTML are commonly known: If you inject data into HTML (e.g. a
template), and cannot be 110% sure it never crossed paths with a
malicious user, you escape it. In PHP this means passing such
data through a function like PHP’s htmlspecialchars(), always
remembering to pass the character encoding of your output as the
third parameter. An alternative exists for cases where you do
not determine the HTML markup of output, for example, when
aggregating content from RSS or Atom feeds, from web service API
responses, from HTML emails, from user comments where HTML is
allowed, or even from the output of HTML transformers such as
libraries which translate BBCode, Markdown or some other
intermediate format into HTML. These alternatives are usually
called HTML Sanitisers or XSS Cleaners. The first case is
simple, easy to execute, and very difficult to spoof. Its main
problem is that it requires f