From: Phlip <phlip2005@...>
Date: 2008-08-21T17:16:46+09:00
Subject: Re: IMG (REGULAR EXPRESSIONS

> You need to consult with your client how clean you need your HTML. If 
> they say to only allow <i>, <em>, <b>, or <strong> tags, for example, 
> you could use XPath to seek '//*', meaning all nodes, then replace their 
> tag names with <span>, delete all their attributes, and write the 
> document back.

Another way to scrub input is don't allow raw HTML. Only allow a wiki markup, 
such as RedCloth. Some wikis allow ''italic'' and '''bold''' content, and very 
little else. Then you don't need to scrub it; you simply let the wiki engine 
convert it to harmless read-only HTML.