News for hackers. Stuff that matters.

A comment on JavaScript must die. Parent comment

Re:JavaScript must die by gdp on Friday September 25, 2009 @07:46AM (#843277)
> Never emit contents of any variable to the browser without treating it with htmlspecialchars() (or equivalent) first.

That seems like one way of using a sledgehammer to needlessly burn server-side CPU cycles.

[ Parent | on HN ]
Re:JavaScript must die by mooism2 on Friday September 25, 2009 @07:59AM (#843293)
Compared to the cost of accessing the database, html-escaping plain text is basically free.
[ Parent | on HN ]
Re:JavaScript must die by gdp on Friday September 25, 2009 @08:19AM (#843310)
'basically free' * lots of users = not free.
[ Parent | on HN ]
Re:JavaScript must die by mooism2 on Friday September 25, 2009 @08:31AM (#843335)
"basically free compared to the cost of something way more expensive" * lots of users = still "basically free compared to the cost of something way more expensive"
[ Parent | on HN ]
Re:JavaScript must die by scotty79 on Friday September 25, 2009 @01:29PM (#843893)
Think like that and you will save one dollar in computing power during normal operation and lose over nine thousand when you'll be forced to clean up mess after xss worm attack.
[ Parent | on HN ]