Every story and comment from the Hacker News API, in a layout borrowed from 2001.
A comment on Don’t try to sanitize input – escape output. Parent comment
You should really do all three:
1) Sanitize input on the server.
2) Use a CSP to prevent your browser from rendering any asset unless specifically whitelisted.
3) Use your front end framework to sanitize text being displayed.
There are no comments on this comment yet.
You should really do all three:
1) Sanitize input on the server.
2) Use a CSP to prevent your browser from rendering any asset unless specifically whitelisted.
3) Use your front end framework to sanitize text being displayed.