Hacker News new | ask | show | jobs
by cesarb 1118 days ago
> There is no issue with producing HTML with string templates.

There is no issue, until you forget to use escaping (or use the wrong one) for one variable, and someone uses that hole to inject arbitrary HTML and/or JS into your page. As long as all your escaping of interpolated variables is perfect, producing HTML with string templates is fine.
1 comments
Izkata 1118 days ago
That's just a bad system, not inherent to templating systems in general. Django (python) got it right: All variables that go into a template are escaped by default, you have to go out of your way to tell it not to do that.

String formatting on the other hand, yeah, no good way like that in a language not designed for it.

Not sure which you and GP meant by "string templates".

link
ec109685 1118 days ago
Unless the template is aware of the semantics of the html being output, it can’t always know how to escape. E.g. the escaping rules are different for a css variable embedded in an inline style compared to using it in a javascript context.

That is what made JSX so neat.

link
theamk 1118 days ago
and modern templating systems do! https://pkg.go.dev/html/template

> This package understands HTML, CSS, JavaScript, and URIs.

No JSX needed.

link