title: How can I sanitize user input but keep the content of <pre> tags?
body: <p>I'm using CKEditor in Markdown format to submit user created content. I would like to sanitize this content from malicious tags, but I would like to keep the formatting that is the result of the markdown parser. I've used two methods that do not work.</p>
  
  <p><strong>Method one</strong></p>
  
  <pre><code>&lt;!--- Sanitize post content ---&gt;
  &lt;cfset this.text = HTMLEditFormat(this.text)&gt;
  &lt;!--- Apply mark down parser ---&gt;
  &lt;cfx_markdown textIn="#this.text#" variable="parsedNewBody"&gt;
  </code></pre>
  
  <p><strong>Problem</strong> For some reason <code>&lt;pre&gt;</code> and <code>&lt;blockquote&gt;</code> are being escaped, and thus I'm unable to use them. Only special characters appear. Other markdown tagging works well, such as bold, italic, etc. Could it be CKEdit does not apply markdown correctly to <code>&lt;pre&gt;</code> and <code>&lt;blockquote&gt;</code>?</p>
  
  <p>Example: If I were to type <code>&lt;pre&gt;&lt;script&gt;alert("!");&lt;/script&gt;&lt;/pre&gt;</code> I would get the following: <code>&amp;lt;script&amp;gt;alert(&amp;quot;!&amp;quot;);&amp;lt;/script&amp;gt;</code></p>
  
  <p><strong>Method two</strong></p>
  
  <p>Same as method one, but reverse the order where the sanitation takes place after the markdown parser has done it's work. This is effectively useless since the sanitation function will escape all the tags, malicious ones or ones created by the markdown parser.</p>
  
  <p>While I want to sanitize malicious content, I do want to keep basic HTML tags and contents of <code>&lt;pre&gt;</code> and <code>&lt;blockquote&gt;</code> tags!--any ideas how?</p>
  
  <p>Thanks!</p>