3 ms·
> HTML was a language that was obvious and easy to generate It was never so. This attitude in fact is the cause of many bugs and security vulnerabilities, most
by ironmagma 5y ago
> HTML was a language that was obvious and easy to generate
It was never so. This attitude in fact is the cause of many bugs and security vulnerabilities, most popularly XSS. There's a reason infrastructure was built around these technologies, one of which is that they are not really safe.
- krapp 5y agoThere's nothing unsafe about HTML as a language. You'll never get an XSS issue from pure HTML. All of those "bugs" and "security vulnerabilities" come from mis-configured frameworks not properly sanitizing external data, or from (mostly PHP) ad-hoc code written by people unaware of the issue. But even then, any mainstream templating language escapes by default.
- ironmagma 5y agoThe parent comment was specifically about generating HTML, which by definition is not pure. And the templating languages are part of the complexity people are talking about.