How does JavaScript-rich text editor prevent XSS injection?

If you want to prevent XSS injection from filtering HTML tags, the Rich text Editor's functionality is gone, filtered together, and if you keep HTML, you can't prevent XSS injection.
How does normal usually deal with this problem??? Filter only specific tags???

Reply content:

If you want to prevent XSS injection from filtering HTML tags, the Rich text Editor's functionality is gone, filtered together, and if you keep HTML, you can't prevent XSS injection.
How does normal usually deal with this problem??? Filter only specific tags???

HTML purifier is an HTML filter written in PHP that can be used with the WYSIWYG editor to filter out XSS malicious code.

  
   purify($html);

I think the whitelist is good, keep the tags you want to use, all the other filters

Your Rich Text editor support what features are not filtered, the other filter on the line. Do you get a P-tag and you want to distinguish whether he added it with your editor or manually?

Do you want to use your own set of new grammar lines?

Just filter out the JS script.

Escaped as an entity character when warehousing
Restore when you are out of the library.
and filter out

javascript:xxx;
This

