News for hackers. Stuff that matters.

A comment on Break Google. Parent comment

Re:Break Google by defen on Friday September 16, 2011 @04:18PM (#3006142)
It's not a poor example, and it's not about sending the document without tags. It's about whether special characters should be escaped, and the answer depends on the Content-Type that the client requested.
[ Parent | on HN ]
Re:Break Google by Peaker on Friday September 16, 2011 @09:59PM (#3007002)
A framework could use static types to tag whether it is escaped or not.

Then, the framework could map different kinds of requests (e.g: raw content vs. html content) to different types.

Then, the only way to convert between the types are functions that do proper escaping.

[ Parent | on HN ]