Where does field help text get filtered? Drupal 7 fields, by default, have a nice text box beneath them for Help Text.  This is set up with field_ui_field_edit_form():

$form['instance']['description'] = array(
  '#type' =&gt; 'textarea',
  '#title' =&gt; t('Help text'),
  '#default_value' =&gt; !empty($instance['description']) ? $instance['description'] : '',
  '#rows' =&gt; 5,
  '#description' =&gt; t('Instructions to present to the user below this field on the editing form.&lt;br /&gt;Allowed HTML tags: @tags', array('@tags' =&gt; _field_filter_xss_display_allowed_tags())),
'#weight' =&gt; -5,
);


Widget forms then can use this when they actually get used, such as from file_field_widget_form():

if (empty($element['#default_value']['fid'])) {
  $element['#description'] = theme('file_upload_help', array('description' =&gt; $element['#description'], 'upload_validators' =&gt; $element['#upload_validators']));
}


Which then get themed, such as with theme_file_upload_help()

if (strlen($description)) {
  $descriptions[] = $description;
}
if (isset($upload_validators['file_validate_size'])) {
  $descriptions[] = t('Files must be less than !size.', array('!size' =&gt; '&lt;strong&gt;' . format_size($upload_validators['file_validate_size'][0]) . '&lt;/strong&gt;'));
}
if (isset($upload_validators['file_validate_extensions'])) {
  $descriptions[] = t('Allowed file types: !extensions.', array('!extensions' =&gt; '&lt;strong&gt;' . check_plain($upload_validators['file_validate_extensions'][0]) . '&lt;/strong&gt;'));
}


The trusty eye will notice that this is user supplied text and it is not being filtered (oh noes!).  Don't worry, it gets filtered somewhere (I actually tested this to be sure).

Where / how does this filtering happen?
In function field_default_form in field.form.inc
line 107

'#description' =&gt; field_filter_xss($instance['description']),