wmd

I have worked the last 2 days on WMD and Markdown , and I don't find THE solution for stock data with security. I would like users to be able to post HTML/XML <code> (with WMD) on my site. For the moment, I stock data in the Markdown format, but if I disable JavaScript the user can easily push XSS. If I strip_tags or html_entities all data I lose the user HTML/XML <code>. How can I do it? In my opinion I must html_entities just the code between pre /pre, but how?! My data is in Markdown. After, what can I do to forbid XSS attributes: <img src="javascript:alert('xss');" /> To "clean" your HTML,

At what stage does my input in the textarea change from being this raw text, and become HTML? For example, say I indent 4 spaces like this Then the WMD Showdown.js will render it properly below this textarea I type in. But the text area still literally contains like this So is PHP server side responsible for translating all the same things the showdown.js does to permanently be HTML in the SoF Database? Willie Wheeler There are some other posts here about this, but basically it works like this. Or at least this is how I do it on my website using WMD; see my profile if you're interested in

Am using django and am implementing WMD on my site, am just wondering how do i convert the markdown syntax to HTML for display purposes, is there some sort of function i should call to do this conversion? What is the best way to handle markdown ie. do i save the markdown as is to the database then parse it when displaying it or should i save the converted HTML then convert it to markup during editing? Check out the markup add-on which comes with Django. That is what you are looking for. To activate these filters, add 'django.contrib.markup' to your INSTALLED_APPS setting. Once you’ve done that

To be clear, I'm referring to the usage of stackoverflow's forked WMD , not the original version from attacklab . I'd like to use the forked version, however it seems that the div id's which are used by the script to identify the page elements to WMDify are hardcoded in wmd.js:66 : // A collection of the important regions on the page. // Cached so we don't have to keep traversing the DOM. wmd.PanelCollection = function(){ this.buttonBar = doc.getElementById("wmd-button-bar"); this.preview = doc.getElementById("wmd-preview"); this.output = doc.getElementById("wmd-output"); this.input = doc