title: Preventing XSS attacks on user submitted HTML content in PHP, the eBay way
body: <p>I've read so many articles describing methods to prevent XSS attacks in user submitted HTML content using functions such a htmlspecialchars and regexs, whitelisting/blacklisting and using html filtering scripts such as HTML Purifier, HTMLawed etc. etc. </p>
  
  <p>Unfortunately, none of these explain how a site like eBay is able to allow such a vast array of potentially malicious HTML tags such as <code>&lt;link&gt;</code>, <code>&lt;script&gt;</code>, <code>&lt;object&gt;</code> and CSS styles and HTML attributes such as background: url() etc. It seems as if they allow users to submit pretty much anything into their item descriptions. I've seen some of the most elaborate HTML, Javascript and Flash templates in item descriptions. </p>
  
  <p>What is eBay doing differently? Is there another technique or layer that I am missing, that allows them to block XSS attacks while still allowing pretty much anything to be included in user's item description?</p>
  
  <p>Any ideas or insight into this would be greatly appreciated! </p>