How to render user inputted html safely with phoenix

Does the string have to be HTML? Can your WYSIWYG be a Markdown editor? If so, you can store the description as Markdown and parse it using something like Earmark.

If not, this might be helpful: GitHub - rrrene/html_sanitize_ex: HTML sanitizer for Elixir · GitHub

No it doesn’t have to be in html, it just was the first thing that came to mind, now I’m wondering if I should use markdown instead

You could use both (kind of like how this editor works) and use the markdown_html/1 function in the HTML Sanitizer package.

I would like to be able to use both for another case where people can make posts, but that’s future me’s problem

Thank you for your help @seanmor5

It is a common idiom to store user input in the input markup language and also store a prerendered version in the database.

You can render those into your response using Phoenix.HTML.raw/1

What do you mean with a prerendered version? A version of the input who has been sanitized?

Well, some editors spit out markdown, others restructured text, some plain HTML. For those that don’t give you the HTML, you need to render the source into HTML.

Rendering it each time the contents is requested might hurt server performance, therefore prerendered version is often cached in the database.

Oh I get it now, I’ll save it pre-rendered then