Not sure if I am going crazy but I thought HTML Purifier used to remove all comments from the HTML by default?

Now it is not doing anyway, and I want to remove them.. all of them. There doesn't seem to be a setting to remove comments, and it doesn't happen by default.. so is this even possible??

(Basically some IE conditional comments are getting copied into a wysiwyg area from Word, and they're not getting removed...)

Still does http://htmlpurifier.org/demo.php?filter%5BAutoFormat.AutoParagraph%5D=0&filter%5BAutoFormat.DisplayLinkURI%5D=0&filter%5BAutoFormat.Linkify%5D=0&filter%5BAutoFormat.RemoveEmpty%5D=0&filter%5BAutoFormat.RemoveSpansWithoutAttributes%5D=0&filter%5BNull_CSS.AllowedProperties%5D=1&filter%5BCore.CollectErrors%5D=0&filter%5BNull_HTML.Allowed%5D=1&filter%5BNull_HTML.Doctype%5D=1&filter%5BHTML.SafeObject%5D=0&filter%5BHTML.TidyLevel%5D=medium&filter%5BURI.DisableExternalResources%5D=0&filter%5BNull_URI.Munge%5D=1&html=%3C%21--+test+--%3E&submit=Submit

Did you change environments?

Thanks for the quick reply - after your assurances I looked for other causes and it seems to be caused by the fact that I had "HTML.Trusted" applied on this website in particular. I don't usually use this but it was actually required at some point and I don't quite remember why... haha :) Maybe there are some comments that need leaving in somewhere, but I see HTML Purifier has the option to do that now anyway - awesome! Will look into that further to see why it was set to Trusted, but I have another question or two now due to this :)

First, what does HTML.Trusted *actually* do - this doesn't seem to be documented properly, like the specifics of it.

Is it possible to have HTML.Trusted set while still removing comments? It seems like this directive does things that can't be override any other way - although maybe I would be better off building all the specific rules I need individually instead of using Trusted?

Thanks for the awesome software anyway, been using it for quite a while now for all sorts of stuff!

It is unspecified, and the point is that you REALLY REALLY should trust your users if you turn it on. It turns on as much as possible, and that amount is monotonically increasing with new versions of HTML Purifier.

How do I let user write PHP HTML JAVASCRIPT code in comments? not functional code, just samples of code.

The usual convention is to use PRE tags plus CDATA.

HTML Purifier, Standards-Compliant HTML Filtering