3 ms·
+1 for template engines. Cheap scanning services only go so far. Any sane template engine should automatically escape all strings when outputting an HTML/XML d
by kijinbear 16y ago
+1 for template engines.
Cheap scanning services only go so far. Any sane template engine should automatically escape all strings when outputting an HTML/XML document, unless the developer explicitly tells it not to. Django does this perfectly. A lot of other modern frameworks also has secure defaults.
PHP is a PITA because it is a template engine in some sense, but it doesn't escape anything by default. PHP's last attempt at something like auto-escaping was magic quotes, which was an epic failure. The few times I need to write vanilla PHP, I end up defining an escaping function and use it instead of echo.
- DanielRibeiro 16y agoYou shouldn't forget that blacklisting is not enough. Whitelisting is usually as important (specially for displaying rss full of html), and there are far fewer open implementations.