# Guidance whitelisting arbitrary HTML attributes?

**URL:** <https://meta.discourse.org/t/guidance-whitelisting-arbitrary-html-attributes/123469>\
**Category:** Support\
**Created:** [July 19, 2019, 9:04pm UTC](https://meta.discourse.org/t/guidance-whitelisting-arbitrary-html-attributes/123469 "2019-07-19T21:04:54Z")\
**Posts on this page:** 1\
**Showing post:** 3

<div class="post-metadata">

**Author:** ![lcestou](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/lcestou/32/148373_2.png) [@lcestou](https://meta.discourse.org/u/lcestou)\
**Post date:** [July 19, 2019, 10:44pm UTC](https://meta.discourse.org/t/guidance-whitelisting-arbitrary-html-attributes/123469/3 "2019-07-19T22:44:16Z")

</div>

Thanks for the quick reply Jeff.

The average user will not be adding the external scripts, only providing divs with data attributes that will be whitelisted to trigger the JS external scripts to fill in the content when those divs are found.

Aren’t divs with attributes (basic HTML) already supported and accepted in the editors for the average user to post? Unless because I’m admin I can also do basic HTML, but they can’t?

Other large websites like wowhead and icyveins have been using these scripts for their users, maybe they are at risk?

Thanks again for your help.

---

_[View the full topic](https://meta.discourse.org/t/guidance-whitelisting-arbitrary-html-attributes/123469)._