{"action":"created","issue":{"url":"https://api.github.com/repos/erusev/parsedown/issues/161","labels_url":"https://api.github.com/repos/erusev/parsedown/issues/161/labels{/name}","comments_url":"https://api.github.com/repos/erusev/parsedown/issues/161/comments","events_url":"https://api.github.com/repos/erusev/parsedown/issues/161/events","html_url":"https://github.com/erusev/parsedown/issues/161","id":32461702,"number":161,"title":"Safe Mode","user":{"login":"clphillips","id":682986,"avatar_url":"https://avatars.githubusercontent.com/u/682986?v=3","gravatar_id":"","url":"https://api.github.com/users/clphillips","html_url":"https://github.com/clphillips","followers_url":"https://api.github.com/users/clphillips/followers","following_url":"https://api.github.com/users/clphillips/following{/other_user}","gists_url":"https://api.github.com/users/clphillips/gists{/gist_id}","starred_url":"https://api.github.com/users/clphillips/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/clphillips/subscriptions","organizations_url":"https://api.github.com/users/clphillips/orgs","repos_url":"https://api.github.com/users/clphillips/repos","events_url":"https://api.github.com/users/clphillips/events{/privacy}","received_events_url":"https://api.github.com/users/clphillips/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/erusev/parsedown/labels/priority","name":"priority","color":"fef2c0"},{"url":"https://api.github.com/repos/erusev/parsedown/labels/suggestion","name":"suggestion","color":"bfd4f2"}],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":26,"created_at":"2014-04-29T16:30:00Z","updated_at":"2015-08-12T18:03:34Z","closed_at":null,"body":"Parsedown offers no safe option for rendering, so, for those of us who allow **no** HTML content within markdown text, we must sanitize prior to feeding to Parsedown. As a result, Parsedown double encodes HTML entities (see #50).\r\n\r\nInstead, Parsedown should offer a \"safe\" option.\r\n\r\n```php\r\nfunction text($text, $safe_mode = false) {\r\n    $this->safe_mode = $safe_mode;\r\n    if ($safe_mode) {\r\n        $text = htmlentities($text, ENT_QUOTES, 'UTF-8');\r\n    }\r\n    ...\r\n}\r\n```\r\nUsage:\r\n```php\r\n$parsedown = new ParseDown();\r\n$text = \"<script>alert('unsafe text');</script>\";\r\necho $parsedown->text($text, true);\r\n```\r\n\r\nOutput:\r\n```\r\n&lt;script&gt;alert(&quote;unsafe text&quote;);&lt/script&gt;\r\n```\r\n\r\n"},"comment":{"url":"https://api.github.com/repos/erusev/parsedown/issues/comments/130394390","html_url":"https://github.com/erusev/parsedown/issues/161#issuecomment-130394390","issue_url":"https://api.github.com/repos/erusev/parsedown/issues/161","id":130394390,"user":{"login":"xorock","id":111481,"avatar_url":"https://avatars.githubusercontent.com/u/111481?v=3","gravatar_id":"","url":"https://api.github.com/users/xorock","html_url":"https://github.com/xorock","followers_url":"https://api.github.com/users/xorock/followers","following_url":"https://api.github.com/users/xorock/following{/other_user}","gists_url":"https://api.github.com/users/xorock/gists{/gist_id}","starred_url":"https://api.github.com/users/xorock/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/xorock/subscriptions","organizations_url":"https://api.github.com/users/xorock/orgs","repos_url":"https://api.github.com/users/xorock/repos","events_url":"https://api.github.com/users/xorock/events{/privacy}","received_events_url":"https://api.github.com/users/xorock/received_events","type":"User","site_admin":false},"created_at":"2015-08-12T18:03:34Z","updated_at":"2015-08-12T18:03:34Z","body":"For several years I used Textile https://github.com/textile/php-textile and there is textileRestricted method which is suitable for untrusted input. As I understand there is no such thing in this library?"}}