3 ms·
Still, OP's right. If you need to let them use plain HTML (it's better to use markdown or something similar) just parse it and remove any attributes and tags no
by Adirael 14y ago
Still, OP's right. If you need to let them use plain HTML (it's better to use markdown or something similar) just parse it and remove any attributes and tags not on your whitelist.
- TeMPOraL 14y agoOr make them use Markdown, org-mode syntax, BBCode or s-expressions ({b text in bold {i and italics}}). User formatting should never go directly to the browser, without being reinterpreted by the website.