Looking for some guidance on why I should use htmlpurifier module for Drupal if I'm purely concerned with security (NOT concerned with preserving inline styles).
migrated from stackoverflow.com Jun 14 '11 at 15:16
I trust the filter_xss function a bit more than htmlpurifier simply due to the complexity of the htmlpurifier code. Neither function is easy to understand, but at least filter_xss is shorter and more stable.
It is true that htmlpurifier is a general library used by other systems and therefore it could have "more eyes" on it. If you look at the HTMLPurifier Summary they claim that kses (which is what filter_xss was originally based on) is "Probably" XSS safe but misses out on other features of HTMLPurifier. The Drupal input format system handles many of the other features that HTMLPurifier mentions in that table so it's not an apples-to-apples comparison.
By the way, you may want to post questions like this to http://drupal.stackexchange.com/ in the future.