title: XSS safety - remove all scripts, allow everything else
body: <p>We are displaying 3rd party HTML on our web page that should correctly render most things, including links and images.  We basically want to sanitize against all scripts, i.e.</p>
  
  <pre><code>&lt;script&gt;...&lt;/script&gt;
  </code></pre>
  
  <p>But things can get pretty creative.  A simple case in which a script can show up outside of a 'script' tag is </p>
  
  <pre><code>&lt;a href="javascript:alert('XSS')"&gt; 
  </code></pre>
  
  <p>And we definitely need to allow links.</p>
  
  <p>In fact as I'm sure many of you know, the problem is pretty brutal:  <a href="http://ha.ckers.org/xss.html" rel="nofollow">http://ha.ckers.org/xss.html</a></p>
  
  <p>If you're in a situation where users are posting comments to your website, you can just get away with escaping all HTML, or maybe escaping all HTML except <code>&lt;em&gt;</code>, <code>&lt;i&gt;</code>, <code>&lt;u&gt;</code> and <code>&lt;s&gt;</code>.  In my case we need to allow all HTML but disable all scripts which is much harder but not an uncommon requirement.  Is there a library or tool that supports this level of HTML-permissiveness and XSS-safety?</p>
  
  <p>Language, in order of preference:  Python, PHP, Java, C/C++.</p>