User Experience Stack Exchange is a question and answer site for user experience researchers and experts. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Suppose a user attempts to post a message to my forum, but their message contains HTML elements that I have chosen not to permit?

e.g. stackexchange and others disallow <table>; All forums (I hope!) disallow <script>

Typically the forum software will remove the tags but leave the content, e.g. a table

  <tr> <td>a</td><td>b</td> </tr>
  <tr> <td>c</td><td>c</td> </tr>

will be replaced with

a b c d

I am considering encoding the < and > instead, so that other users can see the HTML tags that the poster intended to use.

Is this likely to confuse/frustrate users?

share|improve this question
By the way, you really should be thinking "whitelisting allowed html elements and attributes", and not "disallowing bad elements". – Erics Nov 11 '11 at 5:30

It depends a lot on the type of content you expect to be posted. If people are posting messages about HTML code, then treat it as regular text because the tags are part of the subject matter.

If HTML code sharing isn't part of the expected messages, don't show any tags. It makes things harder to read, confuses people, etc. In this case, make a blanket rule that no HTML is allowed and strip it all out, or maybe support a few formatting tags, like b, em and u,

Whatever you decide, be sure to communicate how it works to the people posting messages. That alone will cut down on the amount of frustration, even if people don't always agree with supporting or not supporting HTML tags.

share|improve this answer
As part of communicating how it works you can (a) display a preview alongside the data entry field (just like how SE does here), and/or (b) test to see if their comment includes elements not on the whitelist and actively prevent full submission until they correct their form entry (just like any form validation, really). – Erics Nov 11 '11 at 5:32
@Erics, previewing is hard, but I agree about validation. Why not post that as an answer? – finnw Nov 11 '11 at 6:44

First of all, the guidelines from Todd Sieling are good advice.

If you however decide to show the disallowed content showing the markup including < and >, you have 2 options as far as I can see:

  1. Replace all occurences of < with &lt;, and > with &gt;. This is probably the best approach if this HTML code is not intended as formatting, and you do this to visualize that it is not allowed.

  2. Another approach is to put the whole section with a forbidden HTML inside a <code></code> section. This is the best approach if your reason to support this is to allow HTML code examples.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.