News for hackers. Stuff that matters.

A comment on Comparison with Other Frameworks. Parent comment

Re:Comparison with Other Frameworks by justinsaccount on Saturday October 22, 2016 @01:37PM (#12769631) 

    <h1> <? echo $y->title; ?> </h1>
You forgot htmlspecialchars and now you have XSS. Which is why facebook built XHP originally:

https://www.facebook.com/notes/facebook-engineering/xhp-a-ne...

[ Parent | on HN ]
Re:Comparison with Other Frameworks by g00gler on Sunday October 23, 2016 @03:10PM (#12774919)
Could've sanatized the input before saving it to the database :p
[ Parent | on HN ]