1. Yeah, in PHP it's as simple as generating an MD5 hash, setting that as a session value, and then including it in a form and verifying it when it's POSTed. 2. HTMLPurifier is a good PHP library for cleaning text. But personally, HTML shouldn't be allowed on any site unless you're using a WYSIWYG editor or something.