Re: What characters can go into a CDATA section and a comment? (I found inconsistencies)
"Liam R. E. Quin" <[email protected]>
| Newsgroups | gmane.text.xml.devel |
|---|---|
| Message-ID | <[email protected]> |
On Thu, 2022-03-24 at 08:28 +0000, Peter Flynn wrote: > > CDATA sections are also used by many web developers unsure of exactly > /what/ a user is going to input, and exactly /when/ in subsequent > non-XML processes the markup is going to be stripped, so they use it > as > a safety-net of last resort, which often goes wrong; Yup, this is why CDATA injection attacks are a thing. Little Bobby Tables now works as a back end developer... -- Liam Quin, https://www.delightfulcomputing.com/ Available for XML/Document/Information Architecture/XSLT/ XSL/XQuery/Web/Text Processing/A11Y training, work & consulting. Barefoot Web-slave, antique illustrations: http://www.fromoldbooks.org _______________________________________________________________________ XML-DEV is a publicly archived, unmoderated list hosted by OASIS to support XML implementation and development. To minimize spam in the archives, you must subscribe before posting. [Un]Subscribe/change address: http://www.oasis-open.org/mlmanage/ Or unsubscribe: [email protected] subscribe: [email protected] List archive: http://lists.xml.org/archives/xml-dev/ List Guidelines: http://www.oasis-open.org/maillists/guidelines.php