Due to the massive amounts of spamming going on right now I think there should be some sort of chat room system on there which allows you to create a room and send the link.

Or you could even follow a similar idea to Omegle by pairing two people together but make it so it pairs two people who speak in different languages?

{{{message}}} in handlebars means that if someone one gets around your server-side sanitization your client side is wide open to XSS ...

also, rate limit the users, this is thing is managing to crash chrome!

Working on it, any tips to keep entity encoding in handlebars without the triple stash?

Don't encode entities on the server side if you are using handlebars, it will do that for you (that's the point of using {{}} it will make all user input "safe").

Don't encode entities, just use the DOM (append text nodes).

I built a proof of concept for something like this for someone quite a while ago... what he had that you desperately need is channels. This is entirely useless with any amount of people (particularly when spammers can't be controlled, which is just how the net is). Excellent idea, but it needs some concept of segmentation to be useful.

Totally agree, let's make it happen! http://github.com/mashape/worldchat

I got through with this

  ';alert(String.fromCharCode(88,83,83))//\';alert(String.fromCharCode(88,83,83))//";alert(String.fromCharCode(88,83,83))//\";alert(String.fromCharCode(88,83,83))//--></SCRIPT>">'><SCRIPT>alert(String.fromCharCode(88,83,83))</SCRIPT>

I choose the "German" flag. Does it mean that I should type in German or others' messages are translated to German? It's not at all clear from the wording: "Choose your username and language to start chatting with the world"... What if I want to type in English but read others' messages in German?

Sorry to confuse you, the UX is kinda wonky. Whatever flag you choose is what determines your language for both outgoing and incoming messages. So if you choose German, that is what will determine the "From" language to translate on your outgoing messages and the "To" language for incoming.

Both? It probably means that you write in German and other messages are translated to your language (German).

That's the only thing that would make sense.

This is correct. Basically whatever flag you choose is what determines the "From" translation language on your outgoing messages and the "To" language for incoming.

Since I made this, I'm glad some people like it (and not surprised some don't) but I'd love to answer some technical questions or hear any bugs / issues / security holes you hackers might have found. Cheers!

It feels like I'm being spammed, there isn't enough time to read the messages and its also getting flooded by people with the usernames flood and flooder.

Ya, I tried to implement rate limiting and failed, this was last night at 3am, so let me try again. If you code you might be able to beat me to it: https://github.com/Mashape/worldchat

I'm going out but when I get home I will see what I can do :) EDIT: I think using websockets + node.js would be a better idea.

JavaScript in the body of the message box executes 0.o very cool none-the-less.

Only for you, it gets filtered before going over the wire. Have fun :)

Should still be sanitizing user input, there's no reason to be passing the message as an html variable in handlebars {{{message}}} :/

You trust your server-side sanitization that much?

Do you trust the client side at all?

I trust handlebars with all my user inputs.

TIL Frühstücksfleisch is german for "SPAM"

good job shutting that fellow down. Very cool little app.

edit:

well...maybe some kind of rate limit might help.

I wrote a very similar chat application using google translation, tech demo here: http://speak.ly

Wow, yours is way better!

This is not a feature request by any means. I suspect that this and autocorrect would combine for some seriously funny international humor.

Alternate client: http://montanaflynn.me/mashape/world-chat/

ahem http://i.imgur.com/3LnvN52.png?1

Sorry. To be honest I didn't test on mobile and actually built the site using a 24" thunderbolt display, thanks for the heads up!