I want to convert "> Quotation" to <blockquote> after HTML escape in markdown.

How do I "HTML Conversion" a markdown string after "HTML Escape"?

• markdown can contain HTML fragments
• > and other characters that are meaningful in HTML but are also used in markdown grammar

Therefore, you must not perform HTML escape before converting markdown.

If you want to remove the HTML tag,

• Using the markdown parser
• Write your own using the callback processing of the markdown parser
• DOM manipulation of converted HTML

and so on.

Note: This is the answer to the previous revision of the question.

<blockquote> Why isn't it translated properly

Original Markdown

>Target string

post-escape string

>Target string

Convert to HTML

<p>> interesting string</p>

The interruption of step 2 means that Markdown's quote ">..." is no longer applied and is no longer converted to <blockquote>.

htmlspecialchars can only convert "&", ", ', <, >", so decorations that use "#" are not affected.

Original Markdown

###Target string

post-escape string

###Target string

Convert to HTML

<h3>Target string</h3>

How to successfully convert <blockquote> equivalent decorations while escaping

I don't think cebe/markdown itself is evaluating the input string internally (please confirm), so I think it would be better if the escape was converted from Markdown to HTML.

See also About where htmlspecialchars() can be used to combat vulnerabilities

By the way, cebe/markdown's #106 and #116 recommend HTML Purifier for XSS protection.