Remove XSS, but don't convert to HTML entities Is it possible to configure HTML Purifier so it removes XSS, but doesn't convert characters to HTML entities? I need it for Markdown syntax. Example: > Quote Would be (the same, no XSS): > Quote But this (or any other input with XSS in it): > Quote <script>alert(1)</script> Would be (input with XSS removed): > Quote Is HTML Purifier able to do it? :) http://htmlpurifier.org/phorum/read.php?3,6247,6247#msg-6247 Sat, 25 May 2013 12:52:00 -0400 Phorum 5.2.18 http://htmlpurifier.org/phorum/read.php?3,6247,6252#msg-6252 Re: Remove XSS, but don't convert to HTML entities http://htmlpurifier.org/phorum/read.php?3,6247,6252#msg-6252 Yeah, that's not going to work.

]]> Ambush Commander Support Fri, 09 Mar 2012 12:53:46 -0500 http://htmlpurifier.org/phorum/read.php?3,6247,6251#msg-6251 Re: Remove XSS, but don't convert to HTML entities http://htmlpurifier.org/phorum/read.php?3,6247,6251#msg-6251 Well, that's shame. I was planning to run Markdown on client-side. :(

]]> daGrevis Support Fri, 09 Mar 2012 12:50:26 -0500 http://htmlpurifier.org/phorum/read.php?3,6247,6250#msg-6250 Re: Remove XSS, but don't convert to HTML entities http://htmlpurifier.org/phorum/read.php?3,6247,6250#msg-6250 Oh, I see. No, that's not possible. The encoding of all tags is very important for safety. Run Markdown before.

]]> Ambush Commander Support Fri, 09 Mar 2012 12:43:39 -0500 http://htmlpurifier.org/phorum/read.php?3,6247,6249#msg-6249 Re: Remove XSS, but don't convert to HTML entities http://htmlpurifier.org/phorum/read.php?3,6247,6249#msg-6249 Well, no. According to demo page.

> Quote

...becomes:

> Quote
]]> daGrevis Support Fri, 09 Mar 2012 11:26:07 -0500 http://htmlpurifier.org/phorum/read.php?3,6247,6248#msg-6248 Re: Remove XSS, but don't convert to HTML entities http://htmlpurifier.org/phorum/read.php?3,6247,6248#msg-6248 It should do your specific examples already.

]]> Ambush Commander Support Fri, 09 Mar 2012 11:20:11 -0500 http://htmlpurifier.org/phorum/read.php?3,6247,6247#msg-6247 Remove XSS, but don't convert to HTML entities http://htmlpurifier.org/phorum/read.php?3,6247,6247#msg-6247 Is it possible to configure HTML Purifier so it removes XSS, but doesn't convert characters to HTML entities? I need it for Markdown syntax.

Example:

> Quote

Would be (the same, no XSS):

> Quote

But this (or any other input with XSS in it):

> Quote <script>alert(1)</script>

Would be (input with XSS removed):

> Quote

Is HTML Purifier able to do it? :)

]]> daGrevis Support Fri, 09 Mar 2012 10:10:17 -0500