[development] How to control HTML user input preserving the "style" attributes?

[Konstantin Käfer]

> I believe filter.module does that for security reasons.

The reason why filter.module removes style tags is simple: some dumb  
browsers allow JavaScript inside stylesheets, for example "font- 
size:expression(prompt('Enter a font name:', 'Arial'));". Using that  
you could execute potentially harmful JavaScript code that allows for  
XSS.


Konstantin Käfer – http://kkaefer.com/