title: Best practice for allowing Markdown in Python, while preventing XSS attacks?
body: <p>I need to let users enter Markdown content to my web app, which has a Python back end. I don’t want to needlessly restrict their entries (e.g. by not allowing <em>any</em> HTML, which goes against the spirit and spec of Markdown), but obviously I need to prevent cross-site scripting (XSS) attacks.</p>
  
  <p>I can’t be the first one with this problem, but didn’t see any SO questions with all the keywords “python,” “Markdown,” and “XSS”, so here goes.</p>
  
  <p>What’s a best-practice way to process Markdown and prevent XSS attacks using Python libraries? (Bonus points for supporting <a href="http://michelf.com/projects/php-markdown/extra/" rel="noreferrer">PHP Markdown Extra</a> syntax.)</p>