HTML Escaping

User-provided markdown can contain HTML special characters:

He said <script>alert(1)</script>.

If you blindly insert this, you've created an XSS vulnerability.

The safe approach: ESCAPE HTML special characters by default:

<  -> &lt;
>  -> &gt;
&  -> &amp;
"  -> &quot;
'  -> &#x27;

Input: He said <script>alert(1)</script>.
Output: <p>He said &lt;script&gt;alert(1)&lt;/script&gt;.</p>

CommonMark also allows raw HTML — <div> etc. — but you should NEVER allow this for user content. Run all output through a sanitizer (DOMPurify in JS, bleach in Python).

Untrusted markdown rendering rule: ESCAPE FIRST, then apply markdown structure. Most modern markdown libraries do this safely; older ones (Showdown, marked < 0.6) had XSS bugs.