What XSS / CSRF attacks (if any) should be aware of when video usage is allowed?

Question

I was assigned a project for a website where users will be allowed to upload videos (using the YouTube API), but more importantly (for me) they will also be allowed to upload videos (from numerous video sites, YouTube, Vimeo, etc.).

Having no experience in allowing users to embed a video:
How can I best protect against cross-site scripting and / or cross-site fake requests specifically for embedding videos? What are some common pitfalls to watch?

In minus, I would think to remove all tags except <object>, <param>and <embed>. But I have a feeling that this will not be enough, right?

edit
Also:
Do you consider it possible to allow the use of only known video domains in the attributes <embed src=and <param name="movie" value=to prevent the inclusion of fake flash movies in these attributes?
/ change

If that matters, the environment will be:

• PHP / Zend Framework
• MySQL

bonus points:
Is there a common minimum golden rule / code template for videos that is valid on all video sites that I could use to filter input?

Answer 1

xss (?) - , - DOM... , . .

- , :

Youtube:

<object width="425" height="350">
  <param name="movie" value="http://www.youtube.com/v/AyPzM5WK8ys" />
  <param name="wmode" value="transparent" />
  <embed src="http://www.youtube.com/v/AyPzM5WK8ys"
         type="application/x-shockwave-flash"
         wmode="transparent" width="425" height="350" />
</object>

Vimeo:

<object width="400" height="225">
  <param name="allowfullscreen" value="true" />
  <param name="allowscriptaccess" value="always" />
  <param name="movie" value="http://vimeo.com/moogaloop.swf?clip_id=10239065&amp;server=vimeo.com&amp;show_title=1&amp;show_byline=1&amp;show_portrait=0&amp;color=&amp;fullscreen=1" />
  <embed src="http://vimeo.com/moogaloop.swf?clip_id=10239065&amp;server=vimeo.com&amp;show_title=1&amp;show_byline=1&amp;show_portrait=0&amp;color=&amp;fullscreen=1" type="application/x-shockwave-flash" allowfullscreen="true" allowscriptaccess="always" width="400" height="225"></embed>
</object>
<p><a href="http://vimeo.com/10239065">La Fete (HD - 2010)</a> from <a href="http://vimeo.com/animalcolm">Malcolm Sutherland</a> on <a href="http://vimeo.com">Vimeo</a>.</p>

Metacafe:

<embed src="http://www.metacafe.com/fplayer/4317045/bmx_face_slide.swf" width="400" height="345" wmode="transparent" pluginspage="http://www.macromedia.com/go/getflashplayer" type="application/x-shockwave-flash" allowFullScreen="true" allowScriptAccess="always" name="Metacafe_4317045"> </embed>
<br><font size = 1><a href="http://www.metacafe.com/watch/4317045/bmx_face_slide/">BMX Face Slide</a> - <a href="http://www.metacafe.com/">Free videos are just a click away</a></font>

embed, param, object , .

, javascript-, anchor href...

Edit: src param value - hAx0rs , . : allowScriptAccess. Param, sameDomain/never. SWF javascript:)

Answer 2

, , ?