hi,

i am trying to find ways to sanitize the input of wmd editor

Specifically, I am trying to make HTML tags only available in the <code>tags that wmd generates. Is that possible

My problem is that the following code is rendered as html which is vunerable to potential xss attacks

e.g. <a onmouseover="alert(1)" href="#">read this!</a>

The above code renders normally both in preview mode and when saved to the db.

I notice that SO doesnt seem to have this problem. The same code is just rendered as text.

I notice that SO has shared their code here http://refactormycode.com/codes/333-sanitize-html Do I really have to use c# in order to sanitize wmd to do this?

Any help appreciated , cheers Ke