Re:Don’t try to sanitize input – escape output
by coding123 on Thursday February 27, 2020 @11:42AM
(#22434860)
I like the way react does it:
dangerouslySetInnerHTML={{__html: variable}}
Not only can you easily see every place in the code that is using this construct, but, the framework provides a warning.
I definitely don't think it's bad to sanitize HTML content. but in general MOST text in a web app should be just text, and rendered with whatever HTML it contains. In very few places should the web application give user rich-text (aka HTML) access. In any place that the application does that, sanitization should be used.
dangerouslySetInnerHTML={{__html: variable}}
Not only can you easily see every place in the code that is using this construct, but, the framework provides a warning.
I definitely don't think it's bad to sanitize HTML content. but in general MOST text in a web app should be just text, and rendered with whatever HTML it contains. In very few places should the web application give user rich-text (aka HTML) access. In any place that the application does that, sanitization should be used.