HTML security

[theGAME]

What is wrong with leaving HTML codes On??

I mean why its considered insecure??
I hear a lot of Admins prefer to turn it Off all the time !!

Can someone tell me what is the advantages of Turning HTML Off,in speed,security and everything?

Thanks

[Wayne Luke]

Originally posted by theGAME
What is wrong with leaving HTML codes On??

I mean why its considered insecure??
I hear a lot of Admins prefer to turn it Off all the time !!

Can someone tell me what is the advantages of Turning HTML Off,in speed,security and everything?

Thanks

<script language="javascript">
self.location="http://mysite.com"
</script>

[theGAME]

What is that mean wluke :D

[Martin]

it means they can plant javascript redirects or mouseovers or bombs in your code.

of course, you can leave HTML on and filter "<javascript>" from posts...

[Wayne Luke]

True... Consider a post with something like:

<table><tr><td>Stuff</table>

[theGAME]

Ok,I got it :o

Thanks wluke & Martin

[Sharg]

Ok, and beside javascript, what should we exlude ?

I see html as a real extra value for a forum.

Benj

[Wayne Luke]

I exclude all HTML, but provided a variety of custom bbCode tags that members could use for enhancing their posts.

http://www.sitepointforums.com/index.php?action=bbcode

[Sharg]

Good wluke its much better like you do, I'm going to do the same.

Thanks,
Benj