News for hackers. Stuff that matters.

A comment on The New Haskell.org. Parent comment

Re:The New Haskell.org by runeks on Sunday February 15, 2015 @04:59PM (#9054321)
How does it prevent XSS?
[ Parent | on HN ]
Re:The New Haskell.org by QuixoticChris on Sunday February 15, 2015 @05:13PM (#9054362)
2. XSS injection. Any html coming back from a form will be efficiently sanitized just once on arrival. Unsanitized strings will be sanitized before being displayed.

http://www.yesodweb.com/page/about

I suspect this is accomplished through safe vs. unsafe types. Imagine the only function from `unsafe___` to `safe___` is the escape function, and all functions giving text back in responses is require to be of type `safe___`.

[ Parent | on HN ]