Escape story fields and clean story HTML with HTML Purifier.

Add HTML Purifier 4.19.1. Stories are purified when they are saved and
when they are shown.

lib/htmlpurifier-4.19.1/library/HTMLPurifier/ConfigSchema/schema/Attr.IDPrefix.txt

@@ -0,0 +1,12 @@
+Attr.IDPrefix
+TYPE: string
+VERSION: 1.2.0
+DEFAULT: ''
+--DESCRIPTION--
+String to prefix to IDs.  If you have no idea what IDs your pages may use,
+you may opt to simply add a prefix to all user-submitted ID attributes so
+that they are still usable, but will not conflict with core page IDs.
+Example: setting the directive to 'user_' will result in a user submitted
+'foo' to become 'user_foo'  Be sure to set %HTML.EnableAttrID to true
+before using this.
+--# vim: et sw=4 sts=4