# Nonsense HTML tags allow blank posts

**URL:** https://meta.discourse.org/t/nonsense-html-tags-allow-blank-posts/249253
**Category:** UX
**Created:** [December 18, 2022, 5:26am UTC](https://meta.discourse.org/t/nonsense-html-tags-allow-blank-posts/249253 "2022-12-18T05:26:07Z")
**Posts on this page:** 4
**Page:** 1

<div class="post-metadata">

### Author: ![crcoli7307](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/crcoli7307/32/267901_2.png) [@crcoli7307](https://meta.discourse.org/u/crcoli7307)
#### Post date: [December 18, 2022, 5:26am UTC](https://meta.discourse.org/t/nonsense-html-tags-allow-blank-posts/249253/1 "2022-12-18T05:26:07Z")

</div>

Hello there,

I recently found a bug with Discourse which allows the character limit to be bypassed.

For example, if the character limit is 30 characters, you could put a 30 character HTML tag such as

`<thisisanonsensehtmltaglongerthanthirtycharacters>`

In a post’s body, which would hide the tag and create a post with no visible body, or a body which is truncated.

I suppose that we use a check which only allows for real html tags to be used. Providing an error if it’s invalid.

I’m not too sure if this is known although upon some searching I couldn’t find a similar topic.

The first reply to this topic is an example blank post.

---

<div class="post-metadata">

### Author: ![darkpixlz](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/darkpixlz/32/549896_2.png) [@darkpixlz](https://meta.discourse.org/u/darkpixlz)
#### Post date: [December 18, 2022, 5:30am UTC](https://meta.discourse.org/t/nonsense-html-tags-allow-blank-posts/249253/4 "2022-12-18T05:30:47Z")

</div>

Read:

> [@Bypassing character minimum on posts via HTML](https://meta.discourse.org/t/bypassing-character-minimum-on-posts-via-html/112970/2):
>
> Yes, this is well known, there are many topics on this. Have a search. It’s WONTFIX because there are as many methods to bypass as there are grains of sand on a beach. We only care about the common and easy ones.

---

<div class="post-metadata">

### Author: ![crcoli7307](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/crcoli7307/32/267901_2.png) [@crcoli7307](https://meta.discourse.org/u/crcoli7307)
#### Post date: [December 18, 2022, 5:31am UTC](https://meta.discourse.org/t/nonsense-html-tags-allow-blank-posts/249253/5 "2022-12-18T05:31:29Z")

</div>

Alright you can close then.

My apologies!

---

<div class="post-metadata">

### Author: ![JammyDodger](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/jammydodger/32/254611_2.png) [@JammyDodger](https://meta.discourse.org/u/JammyDodger)
#### Post date: [December 18, 2022, 5:31am UTC](https://meta.discourse.org/t/nonsense-html-tags-allow-blank-posts/249253/6 "2022-12-18T05:31:35Z")

</div>