Escape story fields and clean story HTML with HTML Purifier.

Add HTML Purifier 4.19.1. Stories are purified when they are saved and
when they are shown.

lib/htmlpurifier-4.19.1/library/HTMLPurifier/HTMLModule/Tidy/Name.php

@@ -0,0 +1,33 @@
+<?php
+
+/**
+ * Name is deprecated, but allowed in strict doctypes, so only
+ */
+class HTMLPurifier_HTMLModule_Tidy_Name extends HTMLPurifier_HTMLModule_Tidy
+{
+    /**
+     * @type string
+     */
+    public $name = 'Tidy_Name';
+
+    /**
+     * @type string
+     */
+    public $defaultLevel = 'heavy';
+
+    /**
+     * @return array
+     */
+    public function makeFixes()
+    {
+        $r = array();
+        // @name for img, a -----------------------------------------------
+        // Technically, it's allowed even on strict, so we allow authors to use
+        // it. However, it's deprecated in future versions of XHTML.
+        $r['img@name'] =
+        $r['a@name'] = new HTMLPurifier_AttrTransform_Name();
+        return $r;
+    }
+}
+
+// vim: et sw=4 sts=4