Post History

Switching from HTML to Markdown to minimize risk of HTML injection doesn't make a lot of sense to me, since most Markdown implementations support a subset of HTML inline anyway. The better ones control what subset of HTML to allow by using a sanitizing library, such as (to take just one random example) [Bleach](https://github.com/mozilla/bleach). You might as well just use such a library yourself, if all you're concerned about is security. You'll get the same level of safety—i.e., you're fine as long as the underlying library isn't exploitable—and there will be fewer moving parts to audit and much less of the rest of the system needs to change or be migrated.