8 ms·
That issue is considered a feature by many. Don't send out broken web pages. If you don't build your pages using string concatenation you have already eliminate
by Thiez 4y ago
That issue is considered a feature by many. Don't send out broken web pages. If you don't build your pages using string concatenation you have already eliminated most problems (it's just like SQL, in that respect).
XML parsers are not that bad when you disable custom entities, which browsers could easily do.
- 0x457 4y ago> That issue is considered a feature by many. Don't send out broken web pages. If you don't build your pages using string concatenation you have already eliminated most problems (it's just like SQL, in that respect). Yes, but there weren't many tools to "correctly" compose XHTML back then. > XML parsers are not that bad when you disable custom entities, which browsers could easily do. Yes, but it's another thing browser developers need to think of. A lot of CVEs already originate in browser. Even if it's actually safe, people who got burnt by XML, would have bad opinions about XML in mind.
- dub 4y agoThere's nothing stopping developers from doing server-side validation before sending markup to clients. It seems like the majority of developers have never really wanted to make that cost-benefit tradeoff, though. I ran tons of websites declaring an xhtml doctype through https://validator.w3.org/ https://validator.w3.org/ back before HTML5 when xhtml was still trendy: almost all of the "xhtml" websites failed validation.