HTMLPurifier
Homepage
What is it?
A heavyweight library for sanitizing strings that may contain malicious or 'dirty' HTML.
Why did we choose it?
The comprehensiveness of its checks, and its integration with PHP.
What do we use it for?
Server-side filtering of strings that are submitted in rich text editors, in our case TinyMCE, to ensure they do not contain malicious HTML. In cases where a string didn't come from an input we use a rich text editor for, we can use simpler methods that take less time to run than HTMLPurifier does.