4 ms·
Good point - will add something on that soon. I by no means am a professional programmer, just a hobbyist sharing what I've learned.
by shamdasani 9y ago
Good point - will add something on that soon. I by no means am a professional programmer, just a hobbyist sharing what I've learned.
- s4vi0r 9y agoWhy the `var`s everywhere in the example? They should really be `const`s
- deleted 9y ago[deleted]
- inimino 9y ago`var` still works everywhere, right?
- akvadrako 9y agoCurrent coding examples should be using the current best practice, which is const. If you want to support old browsers without compiling the JS, you are going to have a lot more issues than const/var and is not for beginners.
- rapind 9y agoIt's actually pretty easy to support older browser's without getting into the packaging mess if you don't need a modern framework. Learning webpack is a distraction from learning programming and would overwhelm a lot of the audience IMO.
- inimino 9y agoThe difference between `var` and `const` is irrelevant for beginners. `var` also happens to be the standard on deployed browsers and existing code, and every beginner should recognize it. It’s the least substantive thing you could pick to criticize about this code.
- ColinFCodeChef 9y agoThe gap between a professional and hobbyist is nowhere near as wide as one might think. Great idea, keep at it.
- warent 9y agoUnrelated: you joined >400 days ago and this appears to be your first post? Cool!
- inimino 9y agoTyping `<script>alert(0)</script>` into the chat box shows the injection hazard. In fact this is caused by using jQuery, which (inexcusably) runs embedded scripts when adding HTML to the page. The simplest solution to this entire class of bugs is simply to not use jQuery and use the better-designed DOM methods instead, which is probably a more modern approach anyway. Using innerHTML would solve the script injection, but you probably want to use innerText or createTextNode instead, since supporting HTML tags in a basic chat app seems more bug than feature. The server side should be safe already as it looks like there’s no persistence.
- foota 9y agoinnerHtml wouldn't eliminate xss vectors though, things like load=something could bypass this.
- inimino 9y agoYes, it's not completely safe. In a beginner tutorial, if you allow arbitrary HTML you should state that it shouldn't be done that way in a real app.
- shamdasani 9y agoThanks for the heads up. DOM methods are more clear and better. Will update the tutorial soon.