2 ms·

I can still see it, they haven't removed existing comments yet at least. I can't believe youtube got their input sanitation wrong. Given, that stuff is complex

I can still see it, they haven't removed existing comments yet at least. I can't believe youtube got their input sanitation wrong. Given, that stuff is complex, but with their commenting volume (and quality, I might add) you would expect some due diligence

ks 16y ago
Do they support basic HTML tags in their comments? If not, I see no reason why they shouldn't just replace > and < with > / < after sanitation for some added security