Live data from Hacker News

Break Google

mahdiyusuf.com

91–92 of 92 posts

Re: Break Google

#91

Earlier quoted context omitted.

~ is not unusual on the internet, it is used for home directory webspace http://www.proweb.co.uk/~matt for instance

That's my homepage. It's been a long time since I read it. Reading it now as a treatise from my younger self, though I didn't write it, I realise that spirit is lost. For a while it was "our" place but now we have to return to the underground.

I changed it

http://www.proweb.co.uk/~matt/oldworld.html

Re: Break Google

#92

Earlier quoted context omitted.

Django does this.

No. Django solves the 90% problem, which is usually a fine approach but will llikely lead to security vulnerabilities down the line. I'll refer to something I wrote last time I had this argument: http://pavpanchekha.com/programming/injection.html .

I don't know what you mean by "90% problem", but unlike what your blog article suggests, Django's template engine escapes everything by default. You have to explicitly pass content through a filter to request that it not be escaped.

Based on the fact that the suggestions in your blog article could easily support someone forgetting the "|escape" on a variable, I would accuse your methodology of only solving the "90% problem".

Post reply on HN