Assume you're building a bulletproof CMS for your company.  Cost, time, and technology are no issue.  You've got developers ready to go with the knowledge and experience to crank out outstanding code.  Now, you have to answer the age old CMS question:  what steps do you take to ensure that the code entered into the CMS by the user is acceptable for your site?  I'm thinking beyond just technically escaping a string to make it able to go into a database--there are considerations for w3 standards, filtering for inappropriate content, spelling, and such conundrums as Microsoft Word code scrubbing.  Certainly, there are concerns that I've missed...
What steps should be taken to safeguard user-entered content on a CMS?
cms;standards;content;planning
I think the question here is:How do I get exactly what I want from  my users by making input absurdly easy  for themThe only instance where I see users actually needing to use HTML directly in some form of input is when / if they are formatting tabular data. However, in that case, its much easier to give them a form that can do the same, or any one of the popular grids available in various libraries.I think the golden rule, at least for me is, use a system of markup that is not HTML, which your form handlers can then use to construct beautiful, standards compliant and semantically correct HTML.Third party scanners can (normally) detect most problems with uploaded files. I personally like ClamAV - which is available for both *nix and Windows.That solves the problem of making sure everything is arranged nicely, formatted correctly and no undesirable stuff is being served to visitors, or is it?The other thing you need to do is review any content that they submit, a human being has to have some part in this or stuff is going to be missed. Is that image appropriate? Does that link lead to malware or something else that you would rather not link to? Etc.Providing a flagging mechanism helps, but is always not effective. For instance, if you provide an answer to a two year old question on stackoverflow.com, the question is immediately bumped to the front page where the community is sure to review what was just added. Not all systems are designed with that sort of safeguard in mind.If you do a significant amount of volume when it comes to user contributed content, its probably worth your time to explore using contractors who simply review submissions to make sure inappropriate media / links are weeded out quickly. Or, perhaps you can enlist help from your community of users (if one exists) to do the same, in exchange for some kind of special privileges or extra perks that normal users don't enjoy.