3 ms·
As soon as you start auto-escaping everything, you need to introduce a dontEscapeThis() method that you can use to actually render the HTML you intended. Havin
by jasonkester 16y ago
As soon as you start auto-escaping everything, you need to introduce a dontEscapeThis() method that you can use to actually render the HTML you intended.
Having to do that would be enough to make me ditch any framework in favor of one that treats me like a grownup.
- points 16y agoIt's depressing to see your comment at -1. I guess there are lots of framework lovers here :/
- sbov 16y agoYes, lets needlessly make something harder and less secure in 99% of the cases because people want to be treated like a "grownup". How many times have you written code that actually required raw, dynamic, unescaped html output in a template engine? I think I have... 2 times? And for 2 times I still had to escape the output 50% of the time - when displaying it in a form for the user to edit.
- jrockway 16y agoNot true. What you need is a type system. All data that comes from the user is of type UnescapedUserString. When the templating system sees this, it escapes it when written as HTML. Strings that you type into your program that you don't want to be escaped are of type EscapedString. Add some concatenation rules, and you're done. If you were using Haskell, you wouldn't even need to change much code to do this, thanks to overloaded strings.