# Whitelist all the code inside of a div tag?

**URL:** <https://meta.discourse.org/t/whitelist-all-the-code-inside-of-a-div-tag/51391>\
**Category:** Support\
**Created:** [10월 11, 2016, 9:23오전 UTC](https://meta.discourse.org/t/whitelist-all-the-code-inside-of-a-div-tag/51391 "2016-10-11T09:23:32Z")\
**Posts on this page:** 1\
**Showing post:** 5

<div class="post-metadata">

**Author:** ![Mittineague](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/mittineague/32/114259_2.png) [@Mittineague](https://meta.discourse.org/u/Mittineague)\
**Post date:** [10월 11, 2016, 5:03오후 UTC](https://meta.discourse.org/t/whitelist-all-the-code-inside-of-a-div-tag/51391/5 "2016-10-11T17:03:55Z")

</div>

> [@Alex\_Rabolin](#):
>
> maybe with a plugin like that

If you do that I most certainly want to never visit your forum.

Allowing posts to have inserted JavaScript / iframe code is an **extremely** bad idea.

It opens up the possibility of all kinds of problems ranging from cookie theft to click-jacking to spreading malware and who knows what else.

If you want content from those three specific domains, please, allow only content from those three specific domains and not “\*”

---

_[View the full topic](https://meta.discourse.org/t/whitelist-all-the-code-inside-of-a-div-tag/51391)._