Reference - Parms functions - markdown

<?php

  $post = [ 'body' => "Written by a *visitor*: <script>alert(1)</script> and `{php:getcwd}`" ];

?>

{$post.body | markdown}

<?php

  $s = "<b>x</b>";

?>

A[{$s | markdown}] B[{$s | highlight}] C[{$s | highlight('sql')}] D[{$s | pad:markdown}] E[{$s | upper | highlight}]

<?php
  $post = [ 'body' => "*Hi* & <b>" ];
?>

{$post.body | markdown}

<?php

  // The markdown pipe runs on a value before it is protected, so a value from the request
  // may hold a quote's stand-in (U+E022); it is escaped as the quote it will be, in a link
  // title and in text alike, where it passed the renderer and became a live quote that
  // closed the title attribute the renderer built.

  $b = "[a](http://x \"t\u{E022} onx=1\") and \u{E022} text";

?>

{echo $b | markdown}

<?php
  $text = "# {php:getcwd}\n\n{echo 'x'}";
?>

{$text | markdown}|{markdown $text}

<?php

  // A numeric reference to a control character inside the scheme: html_entity_decode leaves
  // &#13; &#x0D; &#1; &#11; as they are, a browser decodes them and drops the control
  // character, so java&#13;script: was javascript:. A link with a reference to an ordinary
  // character keeps it.

  $text = '[a](java&#13;script:alert(1)) [b](&#1;javascript:alert(1)) [c](java&#x0D;script:alert(1)) [d](java&#11;script:x) [ok](https://e.com/?a=1&#38;b=2)';

?>

{echo $text | markdown}

<?php

  // Strong and em runs that overlap: an em pass opened inside a <strong> and closed after
  // it. Emphasis inside emphasis is kept.

  $nested   = '**foo **bar** baz**';
  $crossing = '**bold *and** italic*';
  $inside   = '*a **b** c* and **a *b* c**';

?>

{$nested | markdown}|{$crossing | markdown}|{$inside | markdown}

<?php
  $text = '[a](javascript&#58top;alert(1)) ![i](x&#x3Ay;) &#58x; &amp; &#123; &#x7B; &copy;';
?>

{echo $text | markdown}

<?php
  $text = "Hi <script>alert(1)</script> [x](javascript:alert(1)) [ok](https://example.com \"t\") and `a<b`";
?>

{echo $text | markdown}

<?php
  $text = '[a](javascript\:alert(1)) ![i](javascript\:alert(1)) [d](data\:text/html,x) [ok](https://example.com/a\_b) [t](x "<https://x/onmouseover=alert(1)//>") [u](<https://example.com/p>)';
?>

{echo $text | markdown}

<?php

  // Lists as editors and document exports write them - a tab after the marker - and a list
  // with an empty item, which is still tight.

  $tabs   = "-\tfoo\n-\tbar";
  $number = "1.\tone\n2.\ttwo";
  $empty  = "- a\n-\n- c";

?>

{$tabs | markdown}|{$number | markdown}|{$empty | markdown}

<?php

  // A value that is all indented code - a comment, a post, a .md file.

  $code = "    \$a = 1;\n    echo \$a;";

?>

{$code | markdown}|{markdown $code}|
  {markdown}
    The pair is dedented with the template around it.
  {/markdown}