I think it's better to store the message body in the database without markdowning it, and then apply markdown whenever you need to render the message. That way, your data storage is more efficient and you don't need to do some nasty hacks like these to prefent csrf injections.