Markdown VS HTML + Purifier? Please help me decide!

As far as I know, markdown will be converted to html for being displayed... so you can have the same security for embedded videos of you configure correctly your purifier.

Purifier should work with a "white list" of things allowed, and escape everything else, so if it's well configured, you should be safe...

I don't know for markdown, but you can find WYSIWYG editors in BBcode. And you can often add many labels to support what you want, and convert it to html in the back-end.

I think you should try to find the one with the most relevant UI for your users, they will never been interested if it's markdown, bbcode or html in the back. That's your job ;)

Both are safe if you handle it properly, and both could handle anything you want.

HTML:

1. Purifier will remove scripts and unwanted attributes (e.g. onhover) if configured to do so.

2. You can embed YouTube videos, you just need to configure the white list to allow iframes. You can even specify the allowed URL's (e.g. allow embeds from YouTube and Vimeo but nothing else).

Markdown is just plain text so it doesn't really need an actual "editor" (front end plugin)? You should use Purifier in any case, since your Markdown will be converted into HTML when displayed on your site.

Technically, there's nothing stopping you from having both. For example, Reddit supports both Markdown and a "fancy pants editor" now.

@Vilfago @Nash Thanks for the answers!

You should use Purifier in any case, since your Markdown will be converted into HTML when displayed on your site.

Hmm, I was thinking that you don't need Purifier when using CommonMark because if html_input is set to escape or strip and allow_unsafe_links is set to false- according to the documentation - you should be safe, right?

Yes, that seems to be the case...as long as whatever package you use can remove unwanted HTML and scripts.

I choose BBcode, I use htmlspecialchars on user input, and then convert bbcode to html.

So no purifier on my side, but a white list of bbcode that could be converted (with some regex).

I used BBCode before on some of my projects and I really like it:

PROS:

• Easy to understand & more user-friendly than Markdown or HTML;
• There are some good WYSIWYG BBCode editors such as SCEditor
• Finally, it's easy to add custom tags (rules), for example:

[youtube]https://www.youtube.com/watch?v=2pLL00WR5iU[/youtube]

or

[youtube]2pLL00WR5iU[/youtube]

CONS:

I've always had trouble finding good, fast and actively maintained parser/converter.

There are not many packages for "parsing"/converting BBCode to HTML, and most of them are based on kaimallea's regex "parser" which fails at complex, nested tags. In fact, every Laravel BBCode converter package uses kaimallea's regex solution.

There are a few other PHP solutions (packages) that are available, but none of them is actively maintained and each has some fails at complex BBCode structures, especially when it comes to nested tags.

phpBB and MyBB have really good BBCode converters, which are also based on regex but way more complex than kaimallea's solution.

I wonder if it's somehow possible to get their converters and use them in our (Laravel) PHP projects? I remember that once I tried to analyze how phpBB's converter works (in order to use it in my Laravel project), but the code was too complex for me and I didn't have enough time.

It would be really great if we could use phpBB or MyBB converters in our own PHP (Laravel) projects!

I coded myself the converter, but it's very similar to kaimallea (unless I didn't use regex for simple tag such as [b] => , but only str_replace().