News for hackers. Stuff that matters.

A comment on Show HN: Draw A Fish and watch it swim with the others. Parent comment

Re:Show HN: Draw A Fish and watch it swim with the others by hyperhello on Friday August 01, 2025 @11:37AM (#44758407)
To be fair, everything on the client is raw string interpolation. It's only secure if you comprehensively vet everything once it's on the server.
[ Parent | on HN ]
Re:Show HN: Draw A Fish and watch it swim with the others by rafram on Friday August 01, 2025 @05:16PM (#44762606)
That's absolutely not true. Sanitization on the client is significantly safer, because the client knows how it parses HTML, while the server can, at best, guess (and hope it follows the spec).

When you set element.textContent = someUserGeneratedContent, the browser guarantees that the user-generated content will never be parsed as HTML.

response.write("<div>" + sanitize(someUserGeneratedContent) + "</div>") has no such guarantee.

[ Parent | on HN ]
Re:Show HN: Draw A Fish and watch it swim with the others by hyperhello on Friday August 01, 2025 @06:58PM (#44763368)
If that’s all you want, it’s trivial to replace all < and & with their encodings.
[ Parent | on HN ]
Re:Show HN: Draw A Fish and watch it swim with the others by Aachen on Sunday August 03, 2025 @03:07PM (#44778871)
That's not sanitisation, that's separating data from executable code. It's a better solution when possible, but the solution suggested above also works
[ Parent | on HN ]