These are more issues with how Javascript is handled on the web. I'd imagine that js sanitizers have gotten more sophisticated so the callback (first) example

These are more issues with how Javascript is handled on the web. I'd imagine that js sanitizers have gotten more sophisticated so the callback (first) example may be a bit weak; if you're accepting code from an unknown source, even if you're filtering it first, you're gonna have a bad time.