2 ms·
Using string templating for HTML is bad/nonexistent web security, so by your argument it does compromise UX.
by yencabulator 3y ago
Using string templating for HTML is bad/nonexistent web security, so by your argument it does compromise UX.
- 1lint 3y agoBy your argument, everyone using string templating for HTML has bad/nonexistent web security. I disagree.
- yencabulator 3y agoNot everyone, just the people whose pages display untrusted inputs. Which is a huge fraction of the modern web... (The rest just have brittle websites that might break when someone uses certain punctuation for the first time.)
- 1lint 3y agoAh okay I see now you were referring to failure to sanitize inputs/outputs in the original comment. I don't know if this oversight occurs more often when using string templating, but I'm pretty sure this was already a problem long before string templating came into practice.
- yencabulator 3y agoIt's literally the reason why HTML templating is done with other means than string concatenation, these days.
- hirvi74 3y agoIsn't that why server side validation exists? What's wrong with letting the user enter whatever they want? It doesn't mean it has to be accepted.
- yencabulator 3y agoValidation can force usernames to be a-z but it doesn't work on freeform text. Forum comments should be able to state that the HTML open comment syntax is <!--
- tomjakubowski 3y agoNot really. Lots of template engines escape and/or sanitize interpolated expressions, according to the context, by default.
- yencabulator 3y agoWell that goes far beyond what I think of as "string templates", now you're parsing the string into HTML.