In my web application I allow user generated content to be posted for public consumption similar to Stackoverflow.
What is the best practice for handing this?
My current steps for handling user generated content are:
I use MarkItUp to allow users an easy way to format their html.
After a user has submitted thier changes I run it through an HTML Sanitizer (scroll to the bottem) that uses a white list approach.
If the Sanitization process has removed any user created content I do not save the content. I then Return there modified content with a warning message, "Some illegal content tags where detected and removed double check your work and try again."
If the content passes through the sanitization process cleanly, I save the raw html content to the database.
When rendering to the client I just pass the raw html out of the db to the page.