I want to implement markdown to my forums.

I research many possible approaches how I would do that and this is what I thought:

A simple approach would involve pagedown on client side and php-markdown on the server.

My approach is to save pure markdown to database and when displaying convert to HTML (with pagedown). Since I already have security layer for my server side (HTML elements whitelist) and all the necessary staff I don't see anything to lose here.

What I win in this case? well I have to modify pagedown to use custom buttons and patterns. That would be hard for me to maintain both php and JavaScript.

My question is: is this good aproach? To break this question:

1. Is there any serious overhead on client side loading about 30 posts and converting it to HTML (performance)
2. With the Idea that I check elements whitelist, is there any security issue I need to know about? (Security)

I want to implement markdown to my forums.

I research many possible approaches how I would do that and this is what I thought:

A simple approach would involve pagedown on client side and php-markdown on the server.

My approach is to save pure markdown to database and when displaying convert to HTML (with pagedown). Since I already have security layer for my server side (HTML elements whitelist) and all the necessary staff I don't see anything to lose here.

What I win in this case? well I have to modify pagedown to use custom buttons and patterns. That would be hard for me to maintain both php and JavaScript.

My question is: is this good aproach? To break this question:

1. Is there any serious overhead on client side loading about 30 posts and converting it to HTML (performance)
2. With the Idea that I check elements whitelist, is there any security issue I need to know about? (Security)

• javascript
• php
• security
• markdown
• pagedown

4 Answers 4

I wouldn't use client side markdown engines. From a few quick googles its of the opinion it's very CPU intensive. Loading 30 posts would add quite a bit of overhead.

If you stored MD in the DB, rendered to HTML on the fly, then employed some caching (memcached or redis) that could work quite well.

In regards to security theres a good read here, it would require some extra sanitising removing scripts/links/redirects etc.

Further reading

• http://functionn.in/resource/remarked-js
• How to use Markdown & MySQL?

Converting markdown from client side is not remended as @Lex has stated. Instead, you can use some online services to convert the markdown top html for you.
Have a look at http://daringfireball/projects/markdown/dingus. You can use curl or something to post markdown to the site and then scrap the website to take the html part. You can also have a look at here http://parsedown/

You have two options to suggest:

• Strapdown - allows to create markdown documents without server-side processing, as you can see on there page, even without code, just by using static files
• markdown-js - allows to create markdown document with client-side processing (javascript)

Here is how I do it:

Save markdown code in db and at rendering I'm caching the result in a file (file, Memcached or any cache storage engine you want). This way I keep the original in database and I`m not wasting resources to pile markdown at each page visit, instead I serve the cache file until it has expired or deleted because of a change.