4 ms·
People have been warning us about sql injection for more than 2 decades, it finally start to pay off and then someone in js invents div.innerHTML=`template aka
by dvh 5y ago
People have been warning us about sql injection for more than 2 decades, it finally start to pay off and then someone in js invents div.innerHTML=`template aka glued strings` and everybody jumps on it like it's no big deal.
- opheliate 5y agoI’m not sure what point you’re making here? IMO, while JS is certainly more bloated than ever as a result, the current popularity of frameworks like React, Vue, etc. makes it much less likely that a beginner will introduce XSS than 10 years ago.
- paulddraper 5y agoThe existence of `innerHtml` or `eval()` or `exec()` etc isn't the problem itself. After all, you could implement the exact same thing in userspace. But yes, anytime you have one program writing instructions for the other, you wind up with a risk for bad composition of those instructions. Fortunately, frameworks and libraries (for SQL and HTML) are increasingly successful at adoption and removing the risk of the programmer using low-level unsafe primitives.