5 ms·
Only escaping output has one significant disadvantage. Say that you are escaping &. You'll get &. Your user then wants to edit the text. You save the edited
by Hitton 7y ago
Only escaping output has one significant disadvantage. Say that you are escaping &. You'll get &. Your user then wants to edit the text. You save the edited text. Now when you escape and output it again, you get &. Rinse and repeat.
- ptx 7y agoNo, that is escaping the input. The article recommendeds storing the text as-is and escaping (that is, converting it to HTML) when it's displayed.
- zAy0LfpBZLC8mAC 7y agoNo, the browser will decode & in the HTML into the '&' character and will submit that character back to you if it is part of some form field.
- Hitton 7y agoWow, I feel really stupid now. That means I have misunderstood how does it work and have evaded it needlessly till now (not that I do much web app development).