3 ms·
Yup. I am suggesting escaping HTML on output (of user input) by default -- making h() the default, essentially. (Incidentally, the reason why this will probabl
by 100k 18y ago
Yup. I am suggesting escaping HTML on output (of user input) by default -- making h() the default, essentially.
(Incidentally, the reason why this will probably never happen is that it would break all of Rails' HTML helpers.)
There are several frameworks that do this already. Django even broke existing apps to make such a change.