hi,
im wondering how wmd is supposed to work,
when i type in the textarea the text doesnt have
html, but once the text is stored in db it turns to
html. wmd also shows all this
html when reloading the content? is it supposed to work like this?
Do I have to sanitize the text before its put into the db? if so how? I thought wmd doesnt deal with html? except in code blocks. Also there are p tags being added
Using the beneath
html it gets added directly. I guess this could cause xss attacks?
- (1) <a onmouseover="alert(1)"
href="#">read this!</a>
- (2) <p <script>alert(1)</script>hello
- (3) </td
<script>alert(1)</script>hello
I wonder how is wmd supposed to work? I thought it was supposed to enter everything in its own mark up, store its on mark up and retrieve it etc. instead of storing plain
html
Chees Ke
