title: What XSS/CSRF attacks (if any) to be aware of when allowing video embeds?
body: <p>I've been assigned a project for a website where users will be allowed to upload video's (using a YouTube API) but more importantly (for me) they will also be allowed to submit video embed codes (from numerous video sites, YouTube, Vimeo, etc. etc.).</p>
  
  <p>Having no experience with allowing users to embed video:<br>
  How can I best protect against cross site scripting and/or cross site request forgery attacks specifically for video embedding? What are some of the common pitfalls to watch for?</p>
  
  <p>At a minumum I would think to strip all tags except <code>&lt;object&gt;</code>, <code>&lt;param&gt;</code> and <code>&lt;embed&gt;</code>. But I have a feeling this will not be enough, will it?</p>
  
  <p><strong>edit</strong><br>
  Also:<br>
  Do you think allowing only known video domainnames in the <code>&lt;embed src=</code> and <code>&lt;param name="movie" value=</code> attributes is enough to prevent rogue flash movies from being embedded in those attributes?<br>
  <strong>/edit</strong></p>
  
  <p>If it is of importance, the environment will be:</p>
  
  <ul>
  <li>PHP/Zend Framework  </li>
  <li>MySQL</li>
  </ul>
  
  <p><strong>Bonuspoints:</strong><br>
  Is there a common minimum golden rule/code template for video embed codes that are valid across all video sites that I could use to filter the input?</p>