sanitize

> But it's much simpler than HTML. I don't know. Everybody knows HTML. It's pretty easy. > If people input with HTML then you're going to need to filter which tags you do and don't want to pass through. That's a solved problem¹²³. > Markdown just gets rid of stuff like that. And you can only use a subset of HTML. I guess there are pros and cons. > Not to mention automatic paragraphing. <p>...</p> ¹https://code.google.com/p/owasp-java-html-sanitizer/ ²https://github.com/rgrove/sanitize ³http://code.google.com/p/google-caja/wiki/JsHtmlSanitizer

As to the security concerns, I strongly recommend passing the results of Markdown compilation into a separate HTML sanitizer library. Preferably one based on whitelisting. You should do this even if your Markdown compiler claims to protect against malicious HTML. The way I see it, a dedicated HTML sanitizer library is less likely to let something through than a Markdown compiler that offers sanitization as an afterthought. For Ruby, I like Sanitize (https://github.com/rgrove/sanitize). I'm sure you can find something similar for any major language.