hi,

im wondering how wmd is supposed to work,

when i type in the textarea the text doesnt have html, but once the text is stored in db it turns to html. wmd also shows all this html when reloading the content? is it supposed to work like this?

Do I have to sanitize the text before its put into the db? if so how? I thought wmd doesnt deal with html? except in code blocks. Also there are p tags being added

Using the beneath html it gets added directly. I guess this could cause xss attacks?

 - (1) <a onmouseover="alert(1)"
   href="#">read this!</a>

 - (2) <p <script>alert(1)</script>hello

 - (3) </td
   <script>alert(1)</script>hello

I wonder how is wmd supposed to work? I thought it was supposed to enter everything in its own mark up, store its on mark up and retrieve it etc. instead of storing plain html

Chees Ke