What can be the downsides of enabling html on a forum?

[WHAT?]

Users could mess with your page's code by posting closing tags. Also, they just post giant pictures or text and ruins the forum for everyone.

 

[jimmy f]

any help would be great guys.

 

[John Stalvern]

It can pose a significant security hole.

 

[flybishop]

Ah, you leave yourself wide open for people to start attacking your other users.

If you let me post html I could make a script that could steal session data from people's computers. That leaves them wide open to XSS attacks and CSRF attacks. If you're going to allow for HTML make sure that it's filtered and that it doesn't execute, so that if someone wanted to post what their code looks like then they can.

 

[flybishop]

Ah, you leave yourself wide open for people to start attacking your other users.

If you let me post html I could make a script that could steal session data from people's computers. That leaves them wide open to XSS attacks and CSRF attacks. If you're going to allow for HTML make sure that it's filtered and that it doesn't execute, so that if someone wanted to post what their code looks like then they can.