允许用户输入安全的HTML子集

public function set($value){
    /*
        First, I want to make sure that we're dealing with a string, so I cast it to a string. Should I throw an error if it's not a string instead?

        Next, I transform \n to <br>, so that whitespace appears correctly. I think it might be better to skip this step and use a CSS rule to allow whitespace.
    */
    $value    =    (string) $value;
    $value    =    nl2br(trim($value));

    /*
        Here is my whitelist. Notice the multiple br elements.
    */
    $value    =    strip_tags($value, "<a><img><table><tr><td><th><h2><h3><h4><blockquote><ul><ol><li><br><br/><br />");

    /*
        This caused some issues in my tests, where it'd unnecessarily escape certain things, so I commented it out. Are shell command injections something I need to worry about?
    */
    //$value    =    escapeshellcmd($value);

    $dom = new DOMDocument;
    if($value === ""){
        return false;
    }
    $dom->loadHTML($value);

    $nodes = $dom->getElementsByTagName('*');
    foreach($nodes as $node){
        if($node->hasAttributes()){
            foreach($node->attributes as $attr){
                $name    =    $attr->name;
                $value    =    $attr->value;
                switch($name){
                    /*
                        These elements are generally safe. Worst case scenario, someone just creates some weird looking HTML, which I'm not too worried about.
                    */
                    case "id":        break;
                    case "style":    break;
                    case "src":        break;
                    case "alt":        break;
                    case "class":    break;
                    /*
                        This is my biggest concern. You can embed inline javascript with <a href="javascript:foo();"></a>, so I want to prevent this. However, links are important so I don't want to completely strip this attribute.
                    */
                    case "href": 
                        if(strpos($value, "javascript") !== false){
                            $node->removeAttribute($name);
                        }
                        break;
                    default:
                        $node->removeAttribute($name);
                        break;
                }
            }
        }
    }

    $value    =    $dom->saveXML($dom->documentElement->firstChild);

    /*
        PHP is weird and adds a bunch of extra elements around the HTML, and it's easiest to just strip the tags again. It's a little hacky, but it works every time (I think).
    */
    $value    =    strip_tags($value, "<a><img><table><tr><td><th><h2><h3><h4><blockquote><ul><ol><li><br><br/><br />");

    /*
        I don't exactly remember why this is here. I think it ensures that all br elements are in the same format, but it probably doesn't do a very good job at it.
    */
    $value    =    str_replace("br/", "br", $value);

    /*
        This ensures that our input is the right length. I chose to do this after we removed all the junk just as a little present for the user.
    */
    if(strlen($value) > $this->length){
        $this->text    =    substr($value, 0, $this->length);
    }else{
        $this->text    =    $value;
    }
    return $this;
}