Is there an Input Filter without built-in restrictions?

Question

Is there an Input Filter without built-in restrictions? The built-in Drupal filters and some of the other filters I have checked seem to come with their built-in restrictions, eg

The Drupal's own HTML Filter format has its own built in restrictions; a list of HTML tags that can be used. JavaScript event attributes, JavaScript URLs, and CSS are always stripped.

The WYSIWYG Filter has built-in restrictions; the following elements cannot be whitelisted due to security reasons, to prevent users from breaking site layout and/or to avoid posting invalid HTML: applet, area, base, basefont, body, button, embed, form, frame, frameset, head, html, iframe, input, isindex, label, link, map, meta, noframes, noscript, object, optgroup, option, param, script, select, style, textarea, title.`

Is there any input filter module without built-in set of restrictions, or that allows the administrator to override them, for use with the Full HTML text format?

Answer 1

You can always just make your own text filter through the admin.

If you head to /admin/config/content/formats and click "+ Add text format," you'll be able to customize your own text format, which includes the roles who can use it, what filters you would like to use (using none should allow for any html tag to get through).

If there are some html tags you don't want showing up in your text format, use "limit allowed HTML" tag, and list the tags you want, like this:

<a> <em> <strong> <cite> <blockquote> <code> <ul> <ol> <li> <dl> <dt> <dd> <blink>

You could event throw (as your example) a tag in there to let it through. There is however, one big warning I need to leave you with:

====================WARNING ========================

Allowing users to place javascript on your page is a huge, huge security threat. If you decide to give users this privilege, make sure it's only with people you absolutely trust. If a text field allows JS to be placed in it, your basicly opening a door for a cross site scripting atttack.

Same holds true for the PHP filter, in fact the php filter is going away in D8, so I would really advise against using that.

Answer 2

the "PHP Code" input filter lets you do whatever you want, but that includes PHP too, use with EXTREME caution.