For those who don’t use ie, every tags are allowed except<iframe> <script> <input> <video> <audio>. Just use put xhtml in an ꜱᴠɢ image!
The image above contains this code, as you can see there are html in it :
<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" w...
@ShadowWizard : This is not for testing stuff, this is a well known workaround on many other sites and an important security point among web rendering engine designers. Stack Exchange for example don’t allow to use tables tags like<tbody> this answer provide an alternative on how to use it and have it’s place on this FAQ like this answer.
@ShadowWizard : And as you can see with the latest edit, this is no different from using html in the post directly.
Never mind. This will be deleted soon enough. If you think you found some security breech, you better contact the team directly (email, "contact us" in the footer etc) and not try and exploit it here.
Because you are only using an image tag and think for some odd reason you are using other tags. You are not, so it's not relevant to this faq. I can also post screenshot of a frame and say "hey, I used iframe"!
@ShadowWizard : This is not a security breach. No web browser ever allowed using ꜱᴠɢ with an ɪᴍg tag with JavaScript, the security level is completely different than using an<iframe>this feature exist specifically for using tags which are not on whitelist. But as you can see the image contains html tags (this is no a screenshot).
An ꜱᴠɢ image doesn’t contains any binary data, but use xml which can contains html as well. Before closing please [look at this link](view-source:http://ytrezq.sdfeu.org/test.svg)!
It seems like a lot of people try to display tables in SO questions but don't do a very good job. Is there any markdown syntax that supports creating a proper table?
@ShadowWizard : Good point! If you load the answer with internet explorer you will see a completely different image with exactly the same file beeing served.
@ShadowWizard And what is the difference ? I could have used<iframe href="http://ytrezq.sdfeu.org/test.svg" width="999">instead of<img src="http://ytrezq.sdfeu.org/test.svg" width="999"> if it was allowed. The only difference would have been that the script inside the image would run (remember the flashing thing with random color order was also using an <img>tag). My point here is that thesrc=""attribute can also load a valid xhtml document and that this no different from using an<iframe>.
@user2284570 no it should be removed because the question is "what tags are allowed?" and there is already answer saying that <img> tag is allowed. Pointless to have another answering just to prove images work.
No matter what you put as the image, it's still inside image tag.
“In addition to random’s answer, if you still need tags which are not allowed, you can do it by using an ꜱᴠɢ inside an<img>tag. The disabled tags will be<iframe><script><input><video>and<audio>.”
@ShadowWizard You didn’t get the purpose of my answer. That’s not the point of it .My answer start with :
My answer doesn’t say the img tag is allowed. It says that the img tag can load xhtml.
It seems like a lot of people try to display tables in SO questions but don't do a very good job. Is there any markdown syntax that supports creating a proper table?
