title: How to Safely Accept Pasted <embed> Code in PHP
body: <p>I want to allow users to paste <code>&lt;embed&gt;</code> and <code>&lt;object&gt;</code> HTML fragments (video players) via an HTML form. The server-side code is PHP. How can I protect against malicious pasted code, JavaScript, etc? I could parse the pasted code, but I'm not sure I could account for all variations. Is there a better way?</p>