From 4c2d79fc6affeea662ebdca44dd98697bc49918d Mon Sep 17 00:00:00 2001 From: Emanuil Rusev Date: Fri, 28 Dec 2018 12:50:30 +0200 Subject: [PATCH] More consistent code blocks in readme --- README.md | 8 ++------ 1 file changed, 2 insertions(+), 6 deletions(-) diff --git a/README.md b/README.md index 5162370..fa94d60 100644 --- a/README.md +++ b/README.md @@ -60,9 +60,7 @@ Parsedown is capable of escaping user-input within the HTML that it generates. A To tell Parsedown that it is processing untrusted user-input, use the following: ```php -$parsedown = new Parsedown; - -$parsedown->setSafeMode(true); +$Parsedown->setSafeMode(true); ``` If instead, you wish to allow HTML within untrusted user-input, but still want output to be free from XSS it is recommended that you make use of a HTML sanitiser that allows HTML tags to be whitelisted, like [HTML Purifier](http://htmlpurifier.org/). @@ -80,9 +78,7 @@ Safe mode does not necessarily yield safe results when using extensions to Parse If you wish to escape HTML **in trusted input**, you can use the following: ```php -$parsedown = new Parsedown; - -$parsedown->setMarkupEscaped(true); +$Parsedown->setMarkupEscaped(true); ``` Beware that this still allows users to insert unsafe scripting vectors, such as links like `[xss](javascript:alert%281%29)`.