4 ms·
Can you expand on escaping on output?
by Something1234 9y ago
Can you expand on escaping on output?
- pornel 9y agoEscaping depends on the context where the string is used, and the same string may be used in many different contexts. For example, you might need to insert someone's name in HTML, JSON, SQL, and e-mail headers/body. Each of these has different escaping syntax, so you can't reliably escape/sanitize the name ahead of time (if you try, people named O'Connor will hate you), so it's best to apply appropriate flavor of escaping as late as possible (e.g. your HTML template engine should apply HTML-escaping, your e-mail library should apply quoted-printable, etc.) Escaping on output also makes text processing easier and more reliable. For example, if you cut a string, you don't have to worry you'll cut it in a middle of an HTML entity or just after a backslash.