# Arbitrary HTML in posts

**URL:** <https://meta.discourse.org/t/arbitrary-html-in-posts/25955>\
**Category:** Feature\
**Created:** [March 4, 2015, 2:23am UTC](https://meta.discourse.org/t/arbitrary-html-in-posts/25955 "2015-03-04T02:23:02Z")\
**Posts on this page:** 1\
**Showing post:** 2

<div class="post-metadata">

**Author:** ![sam](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/sam/32/102149_2.png) [@sam](https://meta.discourse.org/u/sam)\
**Post date:** [March 4, 2015, 2:35am UTC](https://meta.discourse.org/t/arbitrary-html-in-posts/25955/2 "2015-03-04T02:35:28Z")

</div>

To include arbitrary HTML it needs to be whitelisted, trouble is that you do not want a global whitelist of everything cause you open yourself quite wide to arbitrary XSS attacks.

Can you work backwards, what are some examples of problems you are trying to solve?

---

_[View the full topic](https://meta.discourse.org/t/arbitrary-html-in-posts/25955)._