One of the big issues I’ve been trying to work around is how to give people the freedom to be creative but to save them from breaking their site. I had a few moments of downtime and I started thinking: what if users could in fact enter any HTML and CSS they wanted. But. If I find out they’ve entered invalid HTML I find a way to flag the errors and help them correct the problems.
(Invalid HTML would not only harm their site but also the site editor since it is a fancy web page that shows a realtime rendering of the users’ sites. Illegal HTML could break the editor the next time they reload the page.)
So the solution that I just threw into the editor: any user-entered HTML is passed through the Nokogiri parser and if there’s issues then the entire text is HTML-escaped. That way, failing to terminate paired tags, certain spelling mistakes, and missing angle brackets should not cause issues. Of course there’s still issues of broken JavaScript or invalid inline CSS, but that hopefully should not happen too often. It’s like giving users a harmless play area where mistakes don’t cause disasters.
A realization that happened last week was that most site owners will not be doing the data entry for their sites, even if they are creative professionals. It turns out that people are just too busy. Which is why us web designers continue to have jobs. And especially now when small businesses are scrambling to keep their business going they’d rather have a web pro do their site. Because of this the chances of them touching HTML are slim.
However.
They need the ability to embed a YouTube video or insert a Facebook button or some other tracking code.
I thought about blocking this behavior entirely because it does in fact lead to some issues around repackaging the content in a mobile context, but perhaps a more intelligent source parser can just rewrite their video embed code on the fly. In other words, let’s wait until this actually does become a problem. It is also the case that if the web site does turn out to have problems, small biz owners will call their web professional back anyways. Thank goodness for the version-controlled underpinnings of the system.

