3 ms·
One major problem React solves is HTML injection. It used to be an interview question to work at our place, and since React, developers don’t often realize that
by eastbound 5y ago
One major problem React solves is HTML injection. It used to be an interview question to work at our place, and since React, developers don’t often realize that old frameworks like Freemarker didn’t escape HTML. By default.
- arcbyte 5y agoI remember html escaping being a problem in the early 2000s, but promptly solved. Its been solved in every language for over a decade. React didnt do jack to solve it because it was already table stakes and had been for over a decade.
- bennysomething 5y agoGenuine question, what do you mean escape html by default?
- likecarter 5y agoIf someone submits a text field with the contents `<bold>Injection</bold>` that will then be reflected on the site (i.e. a comment section), React will display the literal string, rather than bolded text.
- bennysomething 5y agoAh I see! Thanks