logoalt Hacker News

goatlover • yesterday at 6:03 PM • 1 reply • view on HN

Forums would already have code that sanitizes user input when it's submitted. Users aren't directly setting html elements.

Replies

afavour • yesterday at 6:10 PM

And is that sanitization perfect? Kept up to date?

With a safe API like this one that's tied to the browser's own interpretation of HTML (i.e. it is perfectly placed to know exactly what is and isn't dangerous given it is the one rendering it) wouldn't it be much better to rely on that?