API设计-存储诸如HTML之类的富文本的最佳实践是什么

Question

Let's say you want to be able to display some rich text in your app, and you want to design the backend API for that purpose.

Rich text can be :

• paragraphs
• Some bold or italic texts
• titles from 1 to 6 weight
• images

This is easy to do in HTML.

You could create the rich text I need, then store its whole HTML in the backend model's field.

Then retrieve it through your backend API as a HTML String and display it in a webview in your app or something.

But that sounds like a bad practice although I'm not too sure.

Please share your thoughts and experience about this.

Also, what would be a better practice for this kind of use case ?

Answer 1

It's usually not a good idea to store and display HTML as is, especially if it can be entered by a user (See HTML injection). If the HTML is always from a trusted source however it should be fine to store the HTML as is.

Some better alternatives would be to allow the users to enter markdown instead of HTML, that can then be converted to HTML when it is displayed.

If however markdown does not meet all of your criteria the HTML that will be stored and later displayed should be stripped of all possible malicious tags, for example <script> and <iframe> .

Answer 2

The best means of displaying HTML is likely some kind of web viewing component, which tend to be quite heavy by their nature.

What I would consider, in your situation, is a markdown component. The reason for this is markdown maps to NSAttributedString quite closely.

^^ All opinion, of course.