Markdown to HTML

Why Markdown won

John Gruber's design goal in 2004 was unusual and turned out to be the key to everything: a Markdown document should be readable as plain text, without being converted at all. The syntax is not arbitrary — it codifies the conventions people were already using in plain-text emails to indicate emphasis and structure. Asterisks around a word for emphasis, hashes to mark a heading, hyphens for a bullet list. That is why Markdown feels natural in a way that no markup language before it managed. It has since become the default for READMEs, documentation, static site generators, note-taking apps and chat platforms, largely because it occupies a genuinely useful middle ground: more structure than plain text, vastly less ceremony than HTML.

The sanitisation gap

There is a security consideration that catches people building comment systems and user-facing editors. Markdown permits raw HTML to pass straight through to the output, by design — it is what lets an author drop in a video embed or a custom element when Markdown itself falls short. That is fine when you are the author. It is a cross-site scripting vulnerability when the Markdown came from a user, because a script tag written in a comment will pass through the converter untouched and execute in your readers' browsers. Converting Markdown is not sanitising it. If the source is untrusted, run the resulting HTML through a sanitiser before it reaches a page.