Alexander Makarov
Alexander Makarov
@cebe anything about the topic you can remember?
Cool. Wasn't aware of it. Thanks.
We need @cebe here.
Interesting. The link is definitely not relative.
Do you have an example where it is rendered wrong in the guide?
Markdown doesn't ensure output is secure in any way by design. It is allowing HTML so you don't need to craft it like that, just use `
I don't think escaping HTML is the job of markdown processing library.
It's by design of markdown: https://daringfireball.net/projects/markdown/syntax#autoescape
That's expected. You should process result of markdown conversion with something like http://htmlpurifier.org/ if you want to allow users to enter text.
For example, see https://github.com/yiisoft-contrib/yiiframework.com/blob/master/widgets/views/comments.php#L44 and https://github.com/yiisoft-contrib/yiiframework.com/blob/a88510f17e6fdf225248b822022798baa679d78b/components/Formatter.php#L100