phil ringnalda

While Brad Choate’s Sanitize plugin works great for keeping unwanted HTML (and PHP, ASP, JSP, and SSI) out of your pages that include comments, as a plugin it only gets to affect your rendered pages: the things you don’t want are still in your database, waiting for you to disable the plugin or decide to directly access the comments in your MySQL database.

Luckily, Brad’s plugin design, having the plugin call a separate Perl module, makes it easy to hack it into Movable Type’s comment post code.

If you have the plugin installed, all you have to do is add two lines to {your MT directory}/lib/MT/App/Comments.pm, replacing

    $comment->text($q->param('text'));

(line 98, for mine anyway), with

    use bradchoate::sanitize;
    $comment->text(bradchoate::sanitize::sanitize_html($q->param('text'),
       "a href,strong,em,blockquote"));

(replacing that abbreviated set of allowed tags and attributes with your own) and any future comments will be sanitized before they even make it to your database.