2 ms·

> HTMX abandons all of that, going back to "lol hope your HTML escape function is correct" (and that you use it consistently!). You make this sound like an uns

> HTMX abandons all of that, going back to "lol hope your HTML escape function is correct" (and that you use it consistently!). You make this sound like an unsolved problem. You can use any of the frameworks, including react, in your backend to render HTML and automatically handle all of that for you. In terms of using it consistently? I guess you could say the same about prepared statements. Yes, you have to actually use the tools and not go "lol I'm gonna just pass the HTML myself for no reason."

Nullabillity 3y ago
> You make this sound like an unsolved problem. Because HTML escaping is more complex than it should have to be. Image parsing is also a "solved problem" (if you ignore all the parser bugs that crop up in image libraries all the time). > I guess you could say the same about prepared statements. Actually, prepared statements are another case of doing it right! We finally realized that safely embedding text into SQL queries is way too complex, so instead we submit prepare/parametrize the query, and transfer the values separately using a vastly simpler protocol.