Hi, I am working on a social networking site and I would like to allow users post html embed codes of videos (youtube) or audios (soundcloud) to the site.
I only want to allow codes from these 2 sites (youtube and soundcloud). How do I check and restrict users to this without falling victim of xss or other security threats?
typical youtube video embed code is:
<iframe width="560" height="315" src="http://www.youtube.com/embed/a-5IkDogt_o?rel=0" frameborder="0" allowfullscreen></iframe>
OR
<object width="560" height="315"><param name="movie" value="http://www.youtube.com/v/a-5IkDogt_o?version=3&hl=en_US&rel=0"></param><param name="allowFullScreen" value="true"></param><param name="allowscriptaccess" value="always"></param><embed src="http://www.youtube.com/v/a-5IkDogt_o?version=3&hl=en_US&rel=0" type="application/x-shockwav ...
Go to the complete details ...