Thanks for starting this, it is useful to be able to sanitize more than just user content. Here is some feedback:

  • I ran out of memory while loading the admin settings page (admin/config/development/sanitize). It looks like the three foreach() loops in entity_sanitize_admin_settings() are trying to do too much on my fairly complex D7 site.
  • It would be nice if we could get away from defining the settings in the UI, supplying them through the command-line instead.
  • I would be very happy to help with a 6.x branch, although the name "entity_sanitize" would not fit so well but that's not so important :)
  • A low-priority nice-to-have would be if we could somehow exclude html tags from the str_shuffle(), so that we can continue to see the structure of html in body fields.