That people produce HTML with string templates is telling us something

Re:That people produce HTML with string templates is telling... by chrisandchips on Friday May 26, 2023 @02:49PM (#36088158)

And which of those implications bare importance on string templating?

Of course there are examples of situations where this heuristic doesn't apply, but that doesn't mean its a bad idea that we should totally disregard. This kind of thinking has plagued engineering fields for a long time; Don Norman talks about it in "The Design of Everyday Things". Engineering teams get mad when users don't use their products the "right way", when really they just won't admit to themselves that they've implemented bad design. Simpler, cleaner designs and use patterns tends to win as time goes on.

[ Parent | on HN ]

Re:That people produce HTML with string templates is telling... by lelanthran on Friday May 26, 2023 @03:03PM (#36088307)

I was going to jump in with a pithy DOET quote[1], but you got the essence quite correct: if the intended users of your system can't get it right, then you, the designer, got it wrong.

[1] Maybe something about "probably won awards" :-)

[ Parent | on HN ]

Re:That people produce HTML with string templates is telling... by jeremyjh on Friday May 26, 2023 @05:35PM (#36089779)

Untrusted input has to be escaped before injecting it into an HTML document, or else there is a script injection vulnerability when text from one user is executed as script in another user's browser. Good templating systems eliminate this possibility through parameter systems, but maybe those are still considered string templating systems?

[ Parent | on HN ]