Protect against script injection using markdown

Question

I want to protect my page when a user inputs the following:

<script type="text/javascript">
    alert("hi");
</script>

I'm using ShowDown:

jQuery.fn.markDown = function() 
{
    return this.each(function() {
        var caller = this;
        var converter = new Showdown.converter();

        var text = $(caller).text();
        var html = converter.makeHtml(text);

        $(caller).html(html);
    });
}

Answer 1

One of the solution that could be effective would be to strip all the tag in the source or HTML encode the tag before it is transformed with Showdown.

For how to strip all the HTML tag, there are a couple of way to do it that you can find in this question :

Strip HTML from Text JavaScript

For how to HTML encode the tag, you can use this :

myString.replace(/</g, '&lt;').replace(/>/g, '&gt;');

Note: This will remove you the ability to use HTML in Showdown.