In checking my Magento-powered site for XSS, I've found a couple of problem forms in our custom code, that let users submit arbitrary HTML and script tags that we dutifully inject into our site. (This isn't a Magento bug.)
Instead of trying to always remember to apply a filter on output, I'd like set a PHP filter by default on all input--like
filter.default = full_special_chars in /etc/php.ini. Then, if specific input data needs specific exceptions, use a
filter_input() call with a more-correct filter (e.g., this input is an email address, so use FILTER_SANITIZE_EMAIL).
I know how to implement this in 100% scratch PHP code, but is there a "magento way" to achieve this?