Personalization is a great feature—it allows users to make their personal pages come to life by adding colors, pictures, and even sound—but as with any user input, it is a security threat if not properly sanitized. The creation of a secure online community is a balancing act: your users should be able to personalize their pages using pseudo code or actual HTML, while remaining protected from vandals who might inject malicious JavaScript or otherwise cause harm.

At A List Apart.

[ Read more ]