Safe string checkup against user-supplied suffix/prefix strings Possible Duplicate:
  Is check_plain() enough?  




When authoring own plugin/formatter and giving user an option to provide their own HTML prefix and suffix strings , what would be the Drupal way of ensuring safety of those strings?
Would it suffice to filter_xss with custom list of allowed tags, or a sequence of some functions would be required?
Treat it like any other user input; that is, not to be trusted. Do you have a reason to allow HTML tags in the prefix/suffix? If not, output only after running through check_plain(). filter_xss() is quite permissive in its allowed tags so just be sure you're OK with that before using. See also the drupal.org documentation on handling text in a secure way.