Have Geek Brain

The correct sequence for using Markdown & MySQL?

I want my users to be able to write an article in Markdown, store it in a MySQL database (with the ability to edit it in the future), and display it for other users.

In practice, this is my understanding of how it works:

INPUT

  1. user input via HTML form using Markdown syntax
  2. $queryInput = mysql_real_escape_string($userInput);

  3. insert sanitized string into database

EXIT

  • query field from database
  • $output = Markdown($queryResult);

  • $output

What's this?

Does PHP Markdown eliminate the need for htmlspecialchars

or Pure HTML

?

Thanks!

+2


a source to share


1 answer


I appreciated using markdown in PHP a few weeks ago (and decided not to use it by the way). My thoughts:



  • It is not possible to run a markup parser every time output is displayed - parsing a comment is quite expensive, and a normal blog comment (as an example) is much more read than written. You must run the markup parser before saving the user input to the database!

  • Now the really tricky issue: Markdown doesn't do any security checks by itself. All xss attacks are successfully transmitted. If you're thinking "no problem, I'm just stripping right after user input", think again: it's possible that markdown creates tags containing XSS when handling user input. So you have to check the HTML generated by markdown for security issues - a very difficult task that is very error prone. (This was the reason I didn't use it in my case - the tutorial didn't have a good deal of potential cost)

+2


a source






More articles:


All Articles