Q:

API Design - What are the best practice to store Rich text like HTML

Let's say you want to be able to display some rich text in your app, and you want to design the backend API for that purpose.
Rich text can be : 

paragraphs
Some bold or italic texts
titles from 1 to 6 weight
images

This is easy to do in HTML.
You could create the rich text I need, then store its whole HTML in the backend model's field.
Then retrieve it through your backend API as a HTML String and display it in a webview in your app or something.
But that sounds like a bad practice although I'm not too sure.
Please share your thoughts and experience about this.
Also, what would be a better practice for this kind of use case ?

A:

It's usually not a good idea to store and display HTML as is, especially if it can be entered by a user (See HTML injection). If the HTML is always from a trusted source however it should be fine to store the HTML as is.
Some better alternatives would be to allow the users to enter markdown instead of HTML, that can then be converted to HTML when it is displayed.
If however markdown does not meet all of your criteria the HTML that will be stored and later displayed should be stripped of all possible malicious tags, for example <script> and <iframe>.

