[cheat-master30]

Originally Posted by Michelle

I have read everywhere that letting a user post pure HTML is a site suicide.
I have accepted it for years as an axiom, like 1+1=2.
However, I've seen popular blogging sites to allow their bloggers to change the template by providing them its whole HTML, including <script> tags and everything!
Aren't they afraid? Have they taken any "special measures" to prevent abuse, and if so, what measures?

1. They can use CSS and styling to disrupt the layout massively, or make parts of the login box or other features/links disappear from view.
2. As said, Javascript cookie stealing.
3. Javascript causes really annoying effects such as things flying around or maybe the page upside down/flipped.
4. Iframes to embed viruses and other malware.
5. Iframes or forms to embed fake forms for phishing purposes/stealing passwords, even making the fake form look part of the site.
6. Crashing the browser with an extremely large image.
7. Redirects to other, potentially dangerous/offensive pages.
8. Browser exploits.
9. Annoyances such as leaving tags open to turn everything bold under the empty tag or italic or underline etc...