2 ms·
> Sanitize your inputs. Sadly, there is no "the sanitization". JSON, SQL, HTML, CSS, and URI (and the future formats not invented yet) all require different es
by Joker_vD 7y ago
> Sanitize your inputs.
Sadly, there is no "the sanitization". JSON, SQL, HTML, CSS, and URI (and the future formats not invented yet) all require different escape schemes, so while you can indeed filter out anything that can be interpreted as an escape sequence in any of those formats, that's not something you can always do.
Instead, render your data properly (yes, that includes escaping whatever you're outputting).
- tmpz22 7y agoI particularly enjoy React's dangerouslySetInnerHTML syntax ``` <div dangerouslySetInnerHTML={__html: '<p>hello world</p>'} /> ``` Like they're BEGGING you to never use it but understand sometimes it may be necessary or at least is needed to avoid worse hacks to achieve the same function. I've taken to using prefixes like DANGEROUS or UNSAFE in various parts of our codebase to better indicate to the user where extra caution is needed.