# HTML Whitelisting

**URL:** https://meta.discourse.org/t/html-whitelisting/150251
**Category:** Development
**Created:** [May 3, 2020, 4:21pm UTC](https://meta.discourse.org/t/html-whitelisting/150251 "2020-05-03T16:21:31Z")
**Posts on this page:** 1
**Page:** 1

<div class="post-metadata">

### Author: ![Ghan](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/ghan/32/177964_2.png) [@Ghan](https://meta.discourse.org/u/Ghan)
#### Post date: [May 3, 2020, 4:21pm UTC](https://meta.discourse.org/t/html-whitelisting/150251/1 "2020-05-03T16:21:31Z")

</div>

Is there any guidance on how to properly use the markdown whitelister? In the many examples I’ve been searching through, I see things like: `tag[attribute]` but then there are also cases like `tag.attribute` being added as well. What is the difference between these? What effect does a wildcard have such as `font[face=*]` and are there other control characters you can use in here?

I also never see “class” whitelisted anywhere. Is this allowed by default? How does the system know when you are talking about whitelisting a class value instead of a separate attribute?