4 ms·
There are major HTML platforms, like Windows 8 applications and the new Chrome apps, where inline event handlers are verboten because of the potential for allow
by unwiredben 14y ago
There are major HTML platforms, like Windows 8 applications and the new Chrome apps, where inline event handlers are verboten because of the potential for allowing XSS attacks on applications from external content. Giving only JS code the ability to register more JS code removes this attack surface.