Sanitizing HTML

We've all heard of (or perhaps even experienced) cross-site scripting (XSS) attacks, where evil minded attackers try to inject client-side script or SQL statements into web pages. This could be done to gain access to session cookies or database data, or to get elevated access-privileges to sensitive page content. To verify an HTML document and produce a new HTML document that preserves only whatever tags are designated safe is called sanitizing the HTML.

How to do it...

Look at the web project sanitization. Run the following script and see how the text content and default sanitization works:

1. See how the default sanitization works using the following code:

   var elem1 = new Element.html('<div class="foo">content</div>');
   document.body.children.add(elem1);
   var elem2 = new Element.html('<script class="foo">evil content</script><p>ok?</p>');
   document.body.children.add(elem2);

   The text content and ok? from elem1 and elem2 are displayed, but the console...