4 ms·
You're correct. It's about distinction between code and data. You should simply discern between HTML elements (code) and HTML text nodes (data). Same with prep
by bflesch 2y ago
You're correct. It's about distinction between code and data.
You should simply discern between HTML elements (code) and HTML text nodes (data).
Same with prepared statements: Clear distinction between SQL code vs SQL data.
You just need to ensure that your data is never interpreted as code.
- 0xbadcafebee 2y ago> You just need to ensure that your data is never interpreted as code. That's sanitization. Many different languages implement this. The old-school method is "tainting" data so it can't be used as part of execution without an explicit function call to "untaint" it. Same is used for "secret" data in various programs where you don't want it leaked.