Is allowing Full HTML input for all user roles safe as long as I enable the HTML filter?

  • 2
    If you add the HTML filter to Full HTML, how is it different from the existing Filtered HTML input? Aug 3, 2011 at 19:35
  • There's no difference? It just says it removes javascript and harmful stuff. Not sure Aug 3, 2011 at 19:50
  • 2
    Then why wouldn't you just give them the Filtered HTML input? Aug 3, 2011 at 19:58
  • 1
    I have some content written by an admin that seems to use the default input filter. I want it to use full html. Aug 3, 2011 at 20:37
  • HtmlPurifier solved my problem Aug 3, 2011 at 21:22

2 Answers 2


Only trusted roles and users should have access to Full HTML. You can add some additional allowed tags to the Filtered HTML input format but don't add too many or you risk creating a vulnerability. (admin/settings/filters)

  • Is it possible to allow inline css for allowed tags? Aug 3, 2011 at 20:35
  • You can only add some additional allowed tags to filtered html and still keep it safe. Enabling "full html" for anonymous or putting too many (unsafe) tags into filtered html are two of the most common ways I've seen to make a site insecure.
    – greggles
    Aug 4, 2011 at 15:20
  • To the question "is it possible to allow inline css" - no, Drupal does not have a good tool for filtering CSS to remove cross site scripting.
    – greggles
    Aug 4, 2011 at 15:21
  • @glumbo There's a module for allowing/disallowing certain HTML tag attributes such as style (which is inline CSS): htmLawed. Just throwing it in here maybe it will be useful.
    – Beebee
    Aug 6, 2012 at 8:27

It doesn't really matter what the name of the input format is, if "untrusted" users (see a defintion of trusted roles) are allowed to enter unsafe HTML tags then your site is unsafe.

You can make the Filtered HTML input format unsafe by adding the wrong tags to it or make the "Full HTML" input format more safe by changing its configuration.

I suggest installing the Security Review module and configuring it to know which roles of your site you trust. It will then analyze your input formats to see which are safe and which are not. It also has documentation and links to further resources if it determines that some of your input formats are unsafe. One great resource is the handbook page on configuring input formats for safety.

If you want to make a different input format the default for your admins vs. your regular users, try the Better Formats module.

Not the answer you're looking for? Browse other questions tagged or ask your own question.