3 ms·
No they're not. They're using the word "output" to mean "back into the HTML". "So the better approach is to store whatever name the user enters verbatim, and t
by gkoberger 5y ago
No they're not. They're using the word "output" to mean "back into the HTML".
"So the better approach is to store whatever name the user enters verbatim, and then have the template system HTML-escape when outputting HTML, or properly escape JSON when outputting JSON and JavaScript."
- kam 5y agoThe sentence immediately after that is "And of course use your SQL engine’s parameterized query features so it properly escapes variables when building SQL"