When Putting in a place for users to put it content, (for example, posting a question,answer or comment on this site) What are some things to consider when deciding to use some form of WYSIWYG editor, some form of BBC like markup, or just giving users a plain textarea to work with?
3 Answers
I think SO's minimal editor with markdown syntax has been remarkably effective for the purpose that it serves.
In my opinion, the less HTML you have to deal with in submitted data, the better. Unless users need to organize and post data in tables or something, I really don't see the need for a WYSIWYG editor.
The common tags that you'll want to allow are:
<a>
<blockquote>
<pre>
<b>
<i>
<sup>
<sub>
<ul>
<ol>
<li>
<br>
<img>
Paragraph formatting is easily done on your side. With the exception of a few, markdown or creole can handle pretty much all of that, and validation / sanitation isn't as cumbersome on your end. BBCode is also fine, but not as flexible.
Unless the user is authenticated / trusted somehow, you probably don't want them having at a WYSIWYG editor. Even then, they should be really trusted, beyond just verifying their e-mail or something else that can be trivially accomplished.
-
2+1 For keeping WYSIWYG for trusted input. It can bring up security problem if it's not secured properly and making sure WYSIWYG is secure is pretty hard. There is just so much thing you can do to execute Javascript outside of script tag.– HoLyVieRCommented Jul 30, 2010 at 14:57
-
Good point, I hadn't thought of it like that. My only concern is that less tech-savvy users might not like/understand the markup idea.– GStoCommented Jul 30, 2010 at 15:54
-
@GSto - you can always give little buttons above the textbox to make it simple for them, while more advanced
ninjas
will appreciate being able to just use the markup directly.– Tim PostCommented Jul 30, 2010 at 15:56
I've run into SO many problems with Microsoft Word as a UI person who specializes in custom CMS solutions. While many tools out there have "paste from word" features in them, I can't tell you how many times I've gotten calls late at night because a user "forgot" or "refuses" to use that feature. Without additional post-processing to scrub the miles of gibberish that Word pastes can leave behind, I've even seen DB errors caused by an attempt to inject too much data into a record (on a commercially purchased solution I had to support, nonetheless) My solution, in addition to Tidy, is to standardize on CKEditor because it is programmed to strip out Word markup whether the user "pastes from word" or simply drags-and-drops. Additional post processing and escaping is enabled to protect from injection, spelling errors, flagged keywords and disallowed HTML.
If you're going to give the user the ability to add "extras" to input, carefully consider what extras you're going to give them. Out of the box, most editors have quite a bit that they probably shouldn't in the toolbar. For that reason, BBCode has been something I've pondered many many times. However, for some reason I just keep being drawn back to WYSIWYG because of the "awe" factor it gets in sales meetings and its simplicity for the user (when all is well)
-
I was looking @ CKEditor as an option,and I agree there are too many options in many editors. all i really need are line breaks, links, and some form of simple list.– GStoCommented Jul 30, 2010 at 18:13
Generally, as few options as possible to allow your users to express their ideas. Some sites simply add bold and italic buttons and that works. Any other system will require a certain amount of training. Others to consider are the Markdown and Wikipedia syntaxes. It's also notable that many large sites simply don't allow any additional markup, for example, the Facebook activity stream.
-
thank god Facebook doesnt allow markup... would only make it more irritating. Commented Aug 1, 2010 at 6:14