diff --git a/admin/js/hyperdown.js b/admin/js/hyperdown.js
index 4a4a2615..436fc4a9 100644
--- a/admin/js/hyperdown.js
+++ b/admin/js/hyperdown.js
@@ -1,4 +1,4 @@
-// Generated by CoffeeScript 1.12.1
+// Generated by CoffeeScript 1.12.2
 (function() {
   var Parser,
     slice = [].slice;
@@ -97,6 +97,7 @@
         table: 'table|tbody|thead|tfoot|tr|td|th'
       };
       this.hooks = {};
+      this.html = false;
     }
 
     Parser.prototype.makeHtml = function(text) {
@@ -112,6 +113,10 @@
       return this.call('makeHtml', html);
     };
 
+    Parser.prototype.enableHtml = function(html1) {
+      this.html = html1 != null ? html1 : true;
+    };
+
     Parser.prototype.hook = function(type, cb) {
       if (this.hooks[type] == null) {
         this.hooks[type] = [];
@@ -265,7 +270,7 @@
         return function() {
           var escaped, matches, url;
           matches = 1 <= arguments.length ? slice.call(arguments, 0) : [];
-          escaped = _this.escapeBracket(matches[1]);
+          escaped = htmlspecialchars(_this.escapeBracket(matches[1]));
           url = _this.escapeBracket(matches[2]);
           url = _this.cleanUrl(url);
           return _this.makeHolder("<img src=\"" + url + "\" alt=\"" + escaped + "\" title=\"" + escaped + "\">");
@@ -275,7 +280,7 @@
         return function() {
           var escaped, matches, result;
           matches = 1 <= arguments.length ? slice.call(arguments, 0) : [];
-          escaped = _this.escapeBracket(matches[1]);
+          escaped = htmlspecialchars(_this.escapeBracket(matches[1]));
           result = _this.definitions[matches[2]] != null ? "<img src=\"" + _this.definitions[matches[2]] + "\" alt=\"" + escaped + "\" title=\"" + escaped + "\">" : escaped;
           return _this.makeHolder(result);
         };
@@ -409,6 +414,19 @@
           this.setBlock(key);
           continue;
         }
+        if (this.html) {
+          if (!!(matches = line.match(/^(\s*)!!!(\s*)$/i))) {
+            if (this.isBlock('shtml')) {
+              this.setBlock(key).endBlock();
+            } else {
+              this.startBlock('shtml', key);
+            }
+            continue;
+          } else if (this.isBlock('shtml')) {
+            this.setBlock(key);
+            continue;
+          }
+        }
         if (!!(matches = line.match(new RegExp("^\\s*<(" + special + ")(\\s+[^>]*)?>", 'i')))) {
           tag = matches[1].toLowerCase();
           if (!(this.isBlock('html', tag)) && !(this.isBlock('pre'))) {
@@ -650,6 +668,10 @@
       }
     };
 
+    Parser.prototype.parseShtml = function(lines) {
+      return trim((lines.slice(1, -1)).join("\n"));
+    };
+
     Parser.prototype.parseSh = function(lines, num) {
       var line;
       line = this.parseInline(trim(lines[0], '# '));
@@ -860,10 +882,10 @@
 
     Parser.prototype.cleanUrl = function(url) {
       var matches;
-      if (!!(matches = url.match(/^\s*((http|https|ftp|mailto):[x80-xff_a-z0-9-\.\/%#@\?\+=~\|\,&\(\)]+)/i))) {
+      if (!!(matches = url.match(/^\s*((http|https|ftp|mailto):[x80-xff_a-z0-9-\.\/%#!@\?\+=~\|\,&\(\)]+)/i))) {
         matches[1];
       }
-      if (!!(matches = url.match(/^\s*([x80-xff_a-z0-9-\.\/%#@\?\+=~\|\,&]+)/i))) {
+      if (!!(matches = url.match(/^\s*([x80-xff_a-z0-9-\.\/%#!@\?\+=~\|\,&]+)/i))) {
         return matches[1];
       } else {
         return '#';
diff --git a/var/HyperDown.php b/var/HyperDown.php
index d0b0a81c..a8c549cb 100644
--- a/var/HyperDown.php
+++ b/var/HyperDown.php
@@ -81,6 +81,11 @@ class HyperDown
      */
     private $_id;
 
+    /**
+     * @var bool
+     */
+    private $_html = false;
+
     /**
      * makeHtml
      *
@@ -102,6 +107,14 @@ class HyperDown
         return $this->call('makeHtml', $html);
     }
 
+    /**
+     * @param $html
+     */
+    public function enableHtml($html = true)
+    {
+        $this->_html = $html;
+    }
+
     /**
      * @param $type
      * @param $callback
@@ -319,7 +332,7 @@ class HyperDown
         $text = preg_replace_callback(
             "/!\[((?:[^\]]|\\\\\]|\\\\\[)*?)\]\(((?:[^\)]|\\\\\)|\\\\\()+?)\)/",
             function ($matches) use ($self) {
-                $escaped = $self->escapeBracket($matches[1]);
+                $escaped = htmlspecialchars($self->escapeBracket($matches[1]));
                 $url = $self->escapeBracket($matches[2]);
                 $url = $self->cleanUrl($url);
                 return $self->makeHolder(
@@ -332,7 +345,7 @@ class HyperDown
         $text = preg_replace_callback(
             "/!\[((?:[^\]]|\\\\\]|\\\\\[)*?)\]\[((?:[^\]]|\\\\\]|\\\\\[)+?)\]/",
             function ($matches) use ($self) {
-                $escaped = $self->escapeBracket($matches[1]);
+                $escaped = htmlspecialchars($self->escapeBracket($matches[1]));
 
                 $result = isset( $self->_definitions[$matches[2]] ) ?
                     "<img src=\"{$self->_definitions[$matches[2]]}\" alt=\"{$escaped}\" title=\"{$escaped}\">"
@@ -383,7 +396,7 @@ class HyperDown
         // autolink url
         if ($enableAutoLink) {
             $text = preg_replace_callback(
-                "/(^|[^\"])((https?):[x80-xff_a-z0-9-\.\/%#@\?\+=~\|\,&\(\)]+)($|[^\"])/i",
+                "/(^|[^\"])((https?):[x80-xff_a-z0-9-\.\/%#!@\?\+=~\|\,&\(\)]+)($|[^\"])/i",
                 function ($matches) use ($self) {
                     $link = $self->call('parseLink', $matches[2]);
                     return "{$matches[1]}<a href=\"{$matches[2]}\">{$link}</a>{$matches[4]}";
@@ -534,6 +547,22 @@ class HyperDown
                 continue;
             }
 
+            // super html mode
+            if ($this->_html) {
+                if (preg_match("/^(\s*)!!!(\s*)$/i", $line, $matches)) {
+                    if ($this->isBlock('shtml')) {
+                        $this->setBlock($key)->endBlock();
+                    } else {
+                        $this->startBlock('shtml', $key);
+                    }
+
+                    continue;
+                } else if ($this->isBlock('shtml')) {
+                    $this->setBlock($key);
+                    continue;
+                }
+            }
+
             // html block is special too
             if (preg_match("/^\s*<({$special})(\s+[^>]*)?>/i", $line, $matches)) {
                 $tag = strtolower($matches[1]);
@@ -817,7 +846,7 @@ class HyperDown
         $lang = trim($lang);
         $count = strlen($blank);
 
-        if (! preg_match("/^[_a-z0-9-\+\#\:\.]+$/i", $lang)) {
+        if (!preg_match("/^[_a-z0-9-\+\#\:\.]+$/i", $lang)) {
             $lang = NULL;
         } else {
             $parts = explode(':', $lang);
@@ -855,6 +884,17 @@ class HyperDown
         return preg_match("/^\s*$/", $str) ? '' : '<pre><code>' . $str . '</code></pre>';
     }
 
+    /**
+     * parseShtml
+     *
+     * @param array $lines
+     * @return string
+     */
+    private function parseShtml(array $lines)
+    {
+        return trim(implode("\n", array_slice($lines, 1, -1)));
+    }
+
     /**
      * parseSh
      *
@@ -1149,9 +1189,9 @@ class HyperDown
      */
     public function cleanUrl($url)
     {
-        if (preg_match("/^\s*((http|https|ftp|mailto):[x80-xff_a-z0-9-\.\/%#@\?\+=~\|\,&\(\)]+)/i", $url, $matches)) {
+        if (preg_match("/^\s*((http|https|ftp|mailto):[x80-xff_a-z0-9-\.\/%#!@\?\+=~\|\,&\(\)]+)/i", $url, $matches)) {
             return $matches[1];
-        } else if (preg_match("/^\s*([x80-xff_a-z0-9-\.\/%#@\?\+=~\|\,&]+)/i", $url, $matches)) {
+        } else if (preg_match("/^\s*([x80-xff_a-z0-9-\.\/%#!@\?\+=~\|\,&]+)/i", $url, $matches)) {
             return $matches[1];
         } else {
             return '#';