News for hackers. Stuff that matters.
Re:Stealing passwords from McDonald's users by catmanjan on Sunday January 15, 2017 @10:55PM (#13408109)
If you're displaying user input you could just encode to their matching HTML entities...

{ or the human friendlier one &rcurb (?)

Re:Stealing passwords from McDonald's users by rtpg on Monday January 16, 2017 @01:51AM (#13408566)
that doesn't work because the HTML entity decoding happens before Angular does the scanning of the DOM for the brackets. So even if you use &rcurb; output from the server, Angular will still interpret the brackets "properly"

As to why this works this way, consider the following:

do you have to do HTML entity decoding when getting an input value from Javascript?