WMD Markdown and server-side

Posted on Stack Overflow See other posts from Stack Overflow
Published on 2009-07-23T19:56:35Z Indexed on 2010/04/04 8:03 UTC
Read the original article Hit count: 513

Filed under:

php

|

wmd

|

markdown

Hello,

I work since 2 days on WMD & Markdown and i don't find THE solution for stock data with security. I would like users can post html/xml (with WMD) on my site. For the moment, I stock data in Markdown format but If I disabled JavaScript the user can push easy XSS. If I strip_tags or html_entities all data i loose the user html/xml . How can I do ?

In my opinion I must html_entities just the code between pre /pre, but how?! my data is in Markdown.

After, how I can do for forbid xss attributes :

<img src="javascript:alert('xss');" />

Sorry for my rusty english.

MaxoU

© Stack Overflow or respective owner

Related posts about php

Magento, NGINX, PHP-FPM, APC, MEMCACHED, 16gb Ram CentOS, Spiking PHP-FPM to 100% CPU

as seen on Server Fault - Search for 'Server Fault'
I have been trying to resolve my issue of spiking cpu caused by php-fpm processes. I've reduced the php-fpm config settings to: pm = ondemand pm.max_children = 12 pm.start_servers = 2 pm.min_spare_servers = 2 pm.max_spare_servers = 10 pm.max_requests = 500 php_admin_value[memory_limit] = 128M Problem… >>> More
PHP Pear Installation on CentOS

as seen on Server Fault - Search for 'Server Fault'
[root@ip ~]# yum install php-pear* Reducing CentOS-5 Testing to included packages only Finished Setting up Install Process Package 1:php-pear-1.8.1-2.el5.centos.noarch already installed and latest versio … >>> More
Apache configurations for php "AddType text/html php" or "AddType application/x-httpd-php php .php"

as seen on Server Fault - Search for 'Server Fault'
I am taking over an application server and discover that it contain the following settings: AddType text/html php Although it works, but my understanding is that it should set as following: AddType application/x-httpd-php php .php What are the key differences between the two settings?… >>> More
mod_rewrite settings causes server to throw HTTP 500 errors instead of 404

as seen on Server Fault - Search for 'Server Fault'
Hello. I have a server with VBulletin forum (working under Apache 2.2, CentOS). The default settings for it in .htaccess are as follows: RewriteEngine on RewriteCond %{HTTP_HOST} ^gsmforum\.ru RewriteRule (.*) http://www.gsmforum.ru/$1 [R=301,L] # If you are having problems or are using VirtualDocumentRoot… >>> More
Problems installing Memcache (PECL extension)

as seen on Server Fault - Search for 'Server Fault'
I have installed memcached fine, and now I will need to install PECL extension memcache. Im running RedHat x86_64 es5. The installation gives me this: downloading memcache-2.2.6.tgz ... Starting to download memcache-2.2.6.tgz (35,957 bytes) ..........done: 35,957 bytes 11 source files, building running:… >>> More

Related posts about wmd

wmd editor (jquery version) over ajax forms

as seen on Stack Overflow - Search for 'Stack Overflow'
i'm trying wmd editor over ajax. here there is the bugged code wdm code is based on openlibrary fork on github it work very good without ajax. but when i try to display editor over ajax form it doesn't load. non ajax version produce this html: <div id="wmd-container"> <div id="wmd-button-bar"></div> … >>> More
WMD editor freezes IE7 for 3 seconds on load

as seen on Stack Overflow - Search for 'Stack Overflow'
Hello all, I am using the WMD editor's original code(not the stackoverflow version) since I need multiple of 'em on the same page and stackoverflow's version makes heavy use of element IDs internally since they aren't going to be having more than one editor instance per page. The code runs fin in… >>> More
Using WMD in an iFrame

as seen on Stack Overflow - Search for 'Stack Overflow'
Anyone know how to get WMD working in an iFrame? I'm using this version: http://github.com/ananthakumaran/wmd/ >>> More
WMD Markdown and server-side

as seen on Stack Overflow - Search for 'Stack Overflow'
Hello, I work since 2 days on WMD & Markdown and i don't find THE solution for stock data with security. I would like users can post html/xml (with WMD) on my site. For the moment, I stock data in Markdown format but If I disabled JavaScript the user can push easy XSS. If I strip_tags or html_entities… >>> More
Saving Markdown AND HTML from WMD Control - C# ASP.NET

as seen on Stack Overflow - Search for 'Stack Overflow'
I was wondering if there was a way to get and store both Markdown and the produced HTML for a WMD control. Or do I need to just save the markdown and get a library that can render it to HTML? >>> More