Comments on: The Wrong Defaults

By: dom

dom — Sat, 06 Jun 2009 19:11:10 +0000

@ejunker — WooHoo! There’s hope yet!

By: ejunker

ejunker — Fri, 05 Jun 2009 15:29:40 +0000

The Python web framework Django also escapes template variables by default.

By: dom

dom — Fri, 05 Jun 2009 11:25:32 +0000

That’s awesomely good news. Hopefully something as high-profile as Rails will cause other people to follow suite…

By: Kyle

Kyle — Fri, 05 Jun 2009 09:29:02 +0000

There’s hope yet. In fact Rails 3 has this default set (all output is escaped, you must manually unescape it if you want raw output). I imagine that many frameworks will follow suit in the coming year.

By: Jabbering Giraffe - JSPs in Maven

Jabbering Giraffe - JSPs in Maven — Sat, 27 Dec 2008 19:50:43 +0000

[...] like freemarker or velocity. But JSP is standard, and it’s everywhere. Despite it’s inability to be secure, it is convenient. And that’s gotta count for something [...]