# Arbitrary HTML in posts

**URL:** https://meta.discourse.org/t/arbitrary-html-in-posts/25955
**Category:** Feature
**Created:** [March 4, 2015, 2:23am UTC](https://meta.discourse.org/t/arbitrary-html-in-posts/25955 "2015-03-04T02:23:02Z")
**Posts on this page:** 10
**Page:** 1

<div class="post-metadata">

### Author: ![miko\_matsumura](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/miko_matsumura/32/115727_2.png) [@miko\_matsumura](https://meta.discourse.org/u/miko_matsumura)
#### Post date: [March 4, 2015, 2:23am UTC](https://meta.discourse.org/t/arbitrary-html-in-posts/25955/1 "2015-03-04T02:23:02Z")

</div>

I would like to put arbitrary HTML in posts… I know this is probably a bit crazy. But I want to do it. How should I be thinking about this requirement?

An example would be a form such as this:

```plaintext
<form action="http://www2.gradleware.com/l/68052/2015-01-22/qgt" method="post">

```

---

<div class="post-metadata">

### Author: ![sam](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/sam/32/102149_2.png) [@sam](https://meta.discourse.org/u/sam)
#### Post date: [March 4, 2015, 2:35am UTC](https://meta.discourse.org/t/arbitrary-html-in-posts/25955/2 "2015-03-04T02:35:28Z")

</div>

To include arbitrary HTML it needs to be whitelisted, trouble is that you do not want a global whitelist of everything cause you open yourself quite wide to arbitrary XSS attacks.

Can you work backwards, what are some examples of problems you are trying to solve?

---

<div class="post-metadata">

### Author: ![tobiaseigen](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/tobiaseigen/32/539204_2.png) [@tobiaseigen](https://meta.discourse.org/u/tobiaseigen)
#### Post date: [March 4, 2015, 1:50pm UTC](https://meta.discourse.org/t/arbitrary-html-in-posts/25955/3 "2015-03-04T13:50:32Z")

</div>

Could it be allowed by trust level? Eg everyone at TL4 can post arbitrary html? That is how it works in drupal and I like it.

---

<div class="post-metadata">

### Author: ![elberet](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/elberet/32/122404_2.png) [@elberet](https://meta.discourse.org/u/elberet)
#### Post date: [March 4, 2015, 2:50pm UTC](https://meta.discourse.org/t/arbitrary-html-in-posts/25955/4 "2015-03-04T14:50:29Z")

</div>

Having the ability to post arbitrary HTML is equivalent to full admin rights… so no, neither TL4 users nor mods should have that ability, only full admins.

---

<div class="post-metadata">

### Author: ![Mittineague](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/mittineague/32/114259_2.png) [@Mittineague](https://meta.discourse.org/u/Mittineague)
#### Post date: [March 4, 2015, 3:29pm UTC](https://meta.discourse.org/t/arbitrary-html-in-posts/25955/5 "2015-03-04T15:29:51Z")

</div>

> [@elberet](#):
>
> only full admins

Agreed. Anything that might result in crashing the site, data loss, etc. should be solely in the hands of the Admin.

---

<div class="post-metadata">

### Author: ![miko\_matsumura](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/miko_matsumura/32/115727_2.png) [@miko\_matsumura](https://meta.discourse.org/u/miko_matsumura)
#### Post date: [March 4, 2015, 5:45pm UTC](https://meta.discourse.org/t/arbitrary-html-in-posts/25955/6 "2015-03-04T17:45:06Z")

</div>

I’m ok with requiring full admin… Is this a proposal or is this actually  
how it works?

---

<div class="post-metadata">

### Author: ![sam](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/sam/32/102149_2.png) [@sam](https://meta.discourse.org/u/sam)
#### Post date: [March 4, 2015, 10:20pm UTC](https://meta.discourse.org/t/arbitrary-html-in-posts/25955/7 "2015-03-04T22:20:26Z")

</div>

It is a proposal, but it would be very complicated to add.

---

<div class="post-metadata">

### Author: ![system](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/system/32/443519_2.png) [@system](https://meta.discourse.org/u/system)
#### Post date: [September 15, 2018, 5:47pm UTC](https://meta.discourse.org/t/arbitrary-html-in-posts/25955/8 "2018-09-15T17:47:07Z")

</div>



---

<div class="post-metadata">

### Author: ![sam](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/sam/32/102149_2.png) [@sam](https://meta.discourse.org/u/sam)
#### Post date: [September 16, 2018, 10:00pm UTC](https://meta.discourse.org/t/arbitrary-html-in-posts/25955/9 "2018-09-16T22:00:11Z")

</div>

Though technically doable in a plugin, swinging this safely is excruciatingly difficult

Closing as highly not recommended

---

<div class="post-metadata">

### Author: ![sam](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/sam/32/102149_2.png) [@sam](https://meta.discourse.org/u/sam)
#### Post date: [September 16, 2018, 10:00pm UTC](https://meta.discourse.org/t/arbitrary-html-in-posts/25955/10 "2018-09-16T22:00:17Z")

</div>