# For user submitted content, textile or inspected html?

**URL:** <https://www.ruby-forum.com/t/for-user-submitted-content-textile-or-inspected-html/91765>\
**Category:** Rails\
**Created:** [April 12, 2007, 8:24am UTC](https://www.ruby-forum.com/t/for-user-submitted-content-textile-or-inspected-html/91765 "2007-04-12T08:24:23Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![nicknameoptional](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/n/48db29/32.png) [@nicknameoptional](https://www.ruby-forum.com/u/nicknameoptional)\
**Post date:** [April 12, 2007, 8:24am UTC](https://www.ruby-forum.com/t/for-user-submitted-content-textile-or-inspected-html/91765/1 "2007-04-12T08:24:23Z")

</div>

I know use another markup language, like wiki syntax or textile is to  
prevent javascript injection. But for user who don’t know about wiki  
syntax or textile, I’m thinking about just allow them to enter plain  
html, parse the content, and reject all questionable tags and  
attributes, only allow predefined (safe) tags, like bold or italic,  
etc.

Is using html for markup less secure than using non-html markup?