3 ms·

I don't quite buy his argument about why we need to keep things in unsafe format for a while. If that credit card app can't handle HTML-encoded stuff, how would

• ChadB 18y ago
  Allowing a user to edit the string later is the most common reason I've encountered. No one likes to see an input all cluttered with """, "&" and the like.
• jmtulloss 18y ago
  In general, I find that it's a bad idea to destroy information. Keep all input intact as long as possible, so if you ever do encounter a problem, you don't need to reconstruct the original data. You can always process data into the correct form at runtime. Of course, there are performance implications to this, but those can be dealt with. Encoding strings right away for performance reasons is definitely a premature optimization.