http://sigmaforum.i2p/post/32?reply_to=372
You need to fix this ASAP. Create a whitelist for tags: , , , , , , , , . Strip all other tags. Also sanitize attributes - remove onclick, onerror, onload, and validate that href/src don't start with "javascript:" or "data:" Use a library like bleach or nh3 to handle this - don't try to write your own sanitizer.
1 similar result skipped