6 ms·

You proved their point and you don't even realize it. Those aren't escaped inputs, they're segregated precisely because escaping an input channel is an unwinnab

• insanitybit 2mo ago
  That doesn't seem to prove their point at all and it clearly demonstrates the tractability of escaping inputs for domains like sql/html.
  • friendzis 2mo ago
    The point is lost somewhere. Prepared statements for SQL, innerText for HTML and similar do not show tractability of escaping, they sidestep the escaping problem altogether. Those are interfaces where escaping is no longer needed precisely because they deinterlace instructions from data. Escaping problem inherent to instruction+data channels. Yes, deinterlacing is not solution, not futile attempts to escape.
    • insanitybit 2mo ago
      innerText escapes the text, that's the whole point of Trusted Types. Escaping isn't just "needed", it's literally how those features work.
      • deleted 2mo ago
        [deleted]