I think "parse, don't validate" is an improvement on what the author of this article recommends: « So in cases where you do need to “echo” raw user input, care

I think "parse, don't validate" is an improvement on what the author of this article recommends: « So in cases where you do need to “echo” raw user input, carefully filter input based on a restrictive whitelist, and store the result in the database. When you come to output it, output it as stored without escaping. » I think the "parse, don't validate" approach comes out as follows: - take the list of things you would have included on your whitelist - add nodes for them to your internal representation for parsed markdown - extend your markdown parser to convert html-like input into those nodes - implement output for those nodes in a similar way to normal markdown This way, given the "escape output" they recommend, it's harder for any variant of the input that you hadn't considered to have harmful effects.