javascriptphpsecuritymarkdownpagedown

Parse markdown on the fly

I want to implement markdown to my forums.

I research many possible approaches how I would do that and this is what I thought:

A simple approach would involve pagedown on client side and php-markdown on the server.

My approach is to save pure markdown to database and when displaying convert to HTML (with pagedown). Since I already have security layer for my server side (HTML elements whitelist) and all the necessary staff I don't see anything to lose here.

What I win in this case? well I have to modify pagedown to use custom buttons and patterns. That would be hard for me to maintain both php and JavaScript.

My question is: is this good aproach? To break this question:

  1. Is there any serious overhead on client side loading about 30 posts and converting it to HTML (performance)
  2. With the Idea that I check elements whitelist, is there any security issue I need to know about? (Security)
Solution

  • I wouldn't use client side markdown engines. From a few quick googles its of the opinion it's very CPU intensive. Loading 30 posts would add quite a bit of overhead.

    If you stored MD in the DB, rendered to HTML on the fly, then employed some caching (memcached or redis) that could work quite well.

    In regards to security theres a good read here, it would require some extra sanitising removing scripts/links/redirects etc.

    Further reading