[Digital Jedi]

Originally Posted by EliasAlucard

Do they have to post with special HTML tags or is it enough that someone posts something like <sup> in order to enable HTML to become a vulnerability risk?

The danger doesn't come from the HTML just existing in a post. The danger comes from the person posting using raw HTML code.

Whatever HTML code he puts in a post, becomes that on the forum. If he posts the code that makes a table, it becomes a table in his post. If he posts the raw HTML code for embedding a YouTube video, it becomes an embedded YouTube video in his posts.

So the danger comes from the person, and what he's choosing to post. If he wants to post malicious code, he has fee access to do so. That's why BBCode is more secure. BBCode only turns into the HTML you decided it will turn into.

NOTE: Don't confuse this with the [HTML][/HTML] BBCode tags. This has nothing to do with what they're talking about above. This just displays code in such a way that it stays formatted. No matter what anyone puts here, it will just display text with the spacing preserved and color coding added.

<table>
     <tr>
          <td>This is just a way to share code. It can't actually turn into a table.</td>
     </tr>
</table>