Re:Don’t try to sanitize input – escape output
by TeMPOraL on Thursday February 27, 2020 @07:58AM
(#22432800)
> generate HTML with templating engines that encode data as HTML by default
Don't, unless you're sure the templating engine actually parses the HTML into a tree of nodes before interpolating and re-emitting it. Otherwise it's likely someone will interpolate something in an improper context, e.g. inside <script> or <style> block.
Don't, unless you're sure the templating engine actually parses the HTML into a tree of nodes before interpolating and re-emitting it. Otherwise it's likely someone will interpolate something in an improper context, e.g. inside <script> or <style> block.