Hacker News
points by athrowaway3z 16 hours ago | 0 comments
This is pretty cool, but at the same time i'm horrified that somebody might walk away thinking you need to deny these requests to protect against XSS or SQL injection.

Maybe i want to sell coffee mugs with `<img src=x onerror=alert(document.domain)>` on them.

Parse, dont validate. (And never interpret what shouldn't be)

[–] pwdisswordfishq 16 hours ago
Though in this case, it would be: escape, don't sanitize. "Parse, don't validate" applies to taking inputs; this is about generating outputs (like SQL queries or HTML markup).
[–] Synthetic7346 15 hours ago
Yes, I believe the term is "output encoding"