Security risks from user-submitted HTML

Question

I am using a contentEditable div that allows users to edit the body HTML and then post it directly to site using an AJAX request. Naturally, I have to do some security checks o

Answer 1

Yes and yes.

There are A LOT of ways for users to inject scripts without script tags.

They can do it in JS handlers

They can do it in hrefs

Click me fool!!

They can do it from an external source