title: XSS Prevention, Tidy vs Purifier?
body: <p>Greetings,</p>
  
  <p>I'm trying to prevent XSS and improper html from input fields using CKEditor (a javascript WYSIWYG editor).</p>
  
  <p>How should I filter this data on the server side?  The two options I'm comparing are PHP Tidy and HTML Purifier.  I'm interested in speed, security, and valid nesting.</p>
  
  <p><strong>Edit:</strong> </p>
  
  <p>According to HTML Purifier, Tidy does not prevent XSS.  So, let me specify that I would first pass the user input through </p>
  
  <p><code>strip_tags($input,'&lt;img&gt;&lt;a&gt;&lt;li&gt;&lt;ol&gt;&lt;ul&gt;&lt;b&gt;&lt;br&gt;');</code> before passing to Tidy</p>