有没有任何好的基于PHP的HTML过滤器可用？

就我个人来说,HTML Purifier project的成绩非常好

它是高度可定制的,并有一个巨大的代码库.唯一的问题是将文件上传到您的服务器.

您确定您的安装没有配置问题吗？由于如果配置正确,净化器根本不应该通过任何HTML标签.

从网站：

HTML Purifier is a standards-compliant
HTML filter library written in PHP.
HTML Purifier will not only remove all
malicious code (better known as
XSS) with a thoroughly audited,
secure yet permissive whitelist,it
will also make sure your documents are
standards compliant,something only
achievable with a comprehensive
knowledge of W3C’s specifications.
Tired of using BBCode due to the
current landscape of deficient or
insecure HTML filters? Have a
WYSIWYG editor but never been able to
use it? Looking for high-quality,
standards-compliant,open-source
components for that application
you’re building? HTML Purifier is for
you!

我写了一篇关于如何使用HTML purifier library with CodeIgniter的文章.

也许这将有助于再次尝试：

// load the config and overide defaults as necessary
$config = HTMLPurifier_Config::createDefault();
$config->set('HTML','Doctype','XHTML 1.0 Transitional');
$config->set('HTML','AllowedElements','a,em,blockquote,p,strong,pre,code');
$config->set('HTML','AllowedAttributes','a.href,a.title');
$config->set('HTML','TidyLevel','light');