Sign Up to our social questions and Answers Engine to ask questions, answer people’s questions, and connect with other people.
Login to our social questions & Answers Engine to ask questions answer people’s questions & connect with other people.
Lost your password? Please enter your email address. You will receive a link and will create a new password via email.
Please briefly explain why you feel this question should be reported.
Please briefly explain why you feel this answer should be reported.
Please briefly explain why you feel this user should be reported.
I might be mis-understanding here but from my understanding a markdown editor strips out all html.
After then using a markdown.Transform() type of method this database stored markdown is converted into html with h1, p etc.
With asp.net MVC the general rule is Html.Encode everything.
But does this still apply when using a Markdown editor seeing as Html.Encoding the Transformed markdown will render the generated html useless?
HTML.Encode everything is for potentially unsafe content, usually anything user inputted, if HTML is generated and the input can be trusted (ie run through something that strips the HTML, is run through the XSS library) then you can safely not encode it. To be more explicit you can return an MvcHtmlString rather than a string.