Does the htmlpurifier module for Drupal provide better security against xss (and possibly other vulnerabilities) than Drupal's built in functionality such as filter_xss?

Looking for some guidance on why I should use htmlpurifier module for Drupal if I'm purely concerned with security (NOT concerned with preserving inline styles).

1 Answer 1


I trust the filter_xss function a bit more than htmlpurifier simply due to the complexity of the htmlpurifier code. Neither function is easy to understand, but at least filter_xss is shorter and more stable.

It is true that htmlpurifier is a general library used by other systems and therefore it could have "more eyes" on it. If you look at the HTMLPurifier Summary they claim that kses (which is what filter_xss was originally based on) is "Probably" XSS safe but misses out on other features of HTMLPurifier. The Drupal input format system handles many of the other features that HTMLPurifier mentions in that table so it's not an apples-to-apples comparison.

By the way, you may want to post questions like this to https://drupal.stackexchange.com/ in the future.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.