<p>I'm looking for best practices for performing strict (whitelist) validation/filtering of user-submitted HTML.</p>

<p>Main purpose is to filter out XSS and similar nasties that may be entered via web forms.  Secondary purpose is to limit breakage of HTML content entered by non-technical users e.g. via WYSIWYG editor that has an HTML view.</p>

<p>I'm considering using <a href="http://htmlpurifier.org" rel="noreferrer">HTML Purifier</a>, or rolling my own by using an HTML DOM parser to go through a process like HTML(dirty)->DOM(dirty)->filter->DOM(clean)->HTML(clean).</p>

<p>Can you describe successes with these or any easier strategies that are also effective?  Any pitfalls to watch out for?</p>

User-submitted HTML isn't always valid, or indeed complete. Browsers will interpret a wide range of invalid HTML and you should make sure you can catch it.
Also be aware of the valid-looking:
```
```
<img src="http://www.mysite.com/logout" />
```
```
and
```
```
<a href="javascript:alert('xss hole');">click</a>
```
```