Hacker News Reader

I remember back when XHTML was in vogue (a long time ago now) that there was a blog on the web that advocated for it and somebody posted a comment with an errant character or an unclosed tag or something and overly strict parsing broke the blog on all browsers.

I thought that signaled the death knell of XHTML.

View on HN

That's really just a failure of input sanitation or not properly escaping special characters or putting the comment in CDATA when constructing the XHTML. Basically that blog allowed an injection attack. Not XHTML's fault, the same software would have allowed any comment to do god knows what in HTML.

Reply on news.ycombinator.com