Align the WMD editor's preview HTML with server-side HTML validation (e.g. no embedded JavaScript code)
问题 There are many Stack Overflow questions (e.g. Whitelisting, preventing XSS with WMD control in C# and WMD Markdown and server-side ) about how to do server-side scrubbing of Markdown produced by the WMD editor to ensure the HTML generated doesn't contain malicious script, like this: <img onload="alert('haha');" src="http://www.google.com/intl/en_ALL/images/srpr/logo1w.png" /> But I didn't find a good way to plug the hole on the client side too. Client validation isn't a replacement for