Question

After reading some articles about XSS I have incorporated HTMLPurifier into my zend framework app.

When it comes to securing my forms, I am a little unsure as to which filters are necessary.

Take this snippet:

$aboutme = new \Zend_Form_Element_Textarea('aboutme');
        $aboutme->setLabel(_('About us:'));
        $aboutme->setAttrib('cols', '20')
                ->setAttrib('rows', '20');
        $aboutme->addFilter('StripTags');
        $aboutme->addFilter(new \DCH_Filter_HTMLPurifier);

Should I bother including StripTags as well?

Answer 1

No, you do not need StripTags.