Basically by disallowing read access to /users in the Firebase security rules (which you should do), the latter 50% of the article would be moot. However the ht

Basically by disallowing read access to /users in the Firebase security rules (which you should do), the latter 50% of the article would be moot. However the html injection is interesting, be extra careful to validate data when using dynamic jquery-selectors?