2 ms·
> So Google improperly saved HTML into database string fields and now needs to figure out how to safely render it in a template. FWIW, "store anything, sanitiz
by jamesgeck0 7y ago
> So Google improperly saved HTML into database string fields and now needs to figure out how to safely render it in a template.
FWIW, "store anything, sanitize at render time" is the preferred approach for some popular web frameworks, including Rails.
- rubbingalcohol 7y agoAnd that's fine. To the extent that stored data represents a security risk, sanitization can and should be done on the server side.