Disabling interpretation of all user-input HTML code
How can I disable the interpretation of all HTML tags that users use in their ads?
The 2 related settings I see in the Administrator dashboard do not appear to accomplish it.
1. ClassiPress has a setting under "ClassiPress > Settings > Listings" entitled, "Allow HTML." The tooltip says, "Turn on the TinyMCE editor on text area fields and allows the ad owner to use html markup. Other fields do not allow html by default."
I have this set to NO.
2. WordPress has a setting under "Settings > Media" entitled, "Auto-embeds," which it describes as follows: "When enabled, WordPress will embed the media content from a URL directly onto the page. For example: links to Flickr and YouTube."
I have this UN-MARKED (i.e. disabled).
Still, users can still post descriptions such as:
I am selling this bouquet of flowers, which I picked in this meadow:
<a href="http://www.flickr.com/photos/pierrehanquin/6952179348/">A Pretty Meadow</a>.
Thanks for looking at my ad.
When users view the ad, they see an actual, click-able hyperlink
(instead of raw HTML source or even escaped HTML source). That means the HTML code they enter is being interpreted
before it is displayed on the ad. I think I am either misinterpreting what Appthemes means by "allows the ad owner to use html markup" (which I do not want to allow); or the setting doesn't work for all HTML tags.