Re:Why escape-on-input is a bad idea (2012)
by tdeck on Wednesday October 19, 2022 @11:18PM
(#33270431)
Are there any modern technologies in 2022 that take this approach? I well remember magic quotes (yes it was a WTF) but that's been turned off for ages.
[ Parent
| on HN ]
Re:Why escape-on-input is a bad idea (2012)
by spookylukey on Wednesday October 19, 2022 @11:29PM
(#33270510)
Just the other day I added a recent example to that page, from https://www.wsj.com/articles/internet-mangles-names-accents-... where it is obvious that databases are storing pre-escaped data.
It's not easy to know if that is because of really old data. But changing this is very hard, so I imagine many systems that adopted it once are stuck with it.
Re:Why escape-on-input is a bad idea (2012)
by deathanatos on Thursday October 20, 2022 @12:31AM
(#33270835)
It sort of reminds me of Slack. There's a variety of situations in Slack where Slack will mutate your message prior to storing it & sending it. (I.e., if you edit the message, it will have changed.)
E.g., it will substitute emojis with their short-codes. (And this isn't a valid transformation, and changes some messages, as short codes are not processed inside teletype and code blocks.)
Links also get messed around with, often changing or corrupting the link. Code block begin/ends tend to get (annoyingly) merged with the first/lane lines, which makes editing more difficult.