Movable Type has a
sanitize function that is automatically run against all comments and TrackBacks submitted to your blog and also any content produced by a template tag with the
sanitize attribute defined.
By default, Sanitize is turned on automatically for the following tags:
If you want to turn off sanitize for one of these tags, you can use the
In addition, the sanitization process adds closing tags for any tags left open in the sanitized text. For example, if a visitor to your site opens a
<b> tag and forgets the close it, the sanitize process will add a
</b> tag in the most appropriate place it can find.
This configuration setting defines the default choice for all weblogs. It can be overridden on a per-weblog basis through use of the "Limit HTML tags" option. on the weblog's General setting page. For more details on the "Limit HTML tags" option and the
sanitize function, see the relevant section of Chapter 1.8 in the User and Administration Manual entitled "Default Weblog Display Settings" (you can download the User and Administration Manual here).
The sanitize spec consists of HTML tag names separated by commas. For each tag, you must also list any attributes that you wish to allow, separated by spaces. Some examples:
This will allow
a tags with the
href attribute and
This will allow
p tags and
/ in the
br/ tag in this example. That is necessary because
of the tag-closing feature mentioned above: if the parser sees only an opening
<br> tag, it will think that it needs to close this tag at the
end of the sanitized text. Adding the
/ after the tag name tells the
parser that this tag does not need a closing tag.
Note that you must specify any allowed attributes for the tag, unless you want all of the attributes to be stripped. For example, if you allow the
a tag, you would also want to allow the
href attribute for that tag, or the following HTML:
would be turned into this:
which probably isn't what you want.
If you wish to allow a certain attribute for any HTML tag in which it might appear, use a
* as the tag name, followed by the list of attributes. For example:
This will allow any of the following:
<br style="..." /> <p style="..." /> <blockquote style="...">
Note that you must still explicitly list any tags that you want included;
* just allows the attribute listed in any of those tags.