3 ms·
Isn’t the correct solution to replace '<' and '>' with '<' and '>'?
by colejohnson66 6y ago
Isn’t the correct solution to replace '<' and '>' with '<' and '>'?
- krapp 6y agoYeah, escaping entities when rendering, using prepared statements in the database. It's not rocket science.
- gskourou 6y agoamen
- tannhaeuser 6y agoOr, you know, using ordinary SGML validation which has the capability to block disallowed elements since 1986.
- yyyk 6y agoThe correct solution is to apply Content-Security-Policy plus character escaping as needed.