4 ms·
Noob question here. Does it escape content? I find that incredibly important but I don't see it mentioned anywhere. And what about the alternatives? Yesterday
by glitchdout 14y ago
Noob question here. Does it escape content? I find that incredibly important but I don't see it mentioned anywhere.
And what about the alternatives? Yesterday (in the "The DOM isn't slow. You are." article) there was a talk about laconic and crel. Do those escape content?
- jrajav 14y agoLaconic does [1], this library does not [2]. Laconic uses createTextNode, this uses innerHTML. [1]: https://github.com/joestelmach/laconic/blob/master/laconic.js#L71 https://github.com/joestelmach/laconic/blob/master/laconic.j... [2]: https://github.com/markgandolfo/el.js/blob/master/el.js#L48 https://github.com/markgandolfo/el.js/blob/master/el.js#L48 By the way, HTML encoding is fairly simple, you just have to be sure you get it right. This is a function for it that I include in most projects where I don't already have something like jQuery or laconic: https://gist.github.com/jrajav/5204669 https://gist.github.com/jrajav/5204669
- glitchdout 14y agoI've only recently started to dabble with javascript and its pitfalls such as XSS attacks. Using jQuery was the only solution I found to escape user generated and that gist will come in handy when I don't want to depend on that framework. Thank you for that.
- korynunn 14y agocrel uses createTextNode, so yes.