Hacker News Reader

That issue is considered a feature by many. Don't send out broken web pages. If you don't build your pages using string concatenation you have already eliminated most problems (it's just like SQL, in that respect).

XML parsers are not that bad when you disable custom entities, which browsers could easily do.

View on HN

There's nothing stopping developers from doing server-side validation before sending markup to clients.

It seems like the majority of developers have never really wanted to make that cost-benefit tradeoff, though. I ran tons of websites declaring an xhtml doctype through https://validator.w3.org/ back before HTML5 when xhtml was still trendy: almost all of the "xhtml" websites failed validation.

> That issue is considered a feature by many. Don't send out broken web pages. If you don't build your pages using string concatenation you have already eliminated most problems (it's just like SQL, in that respect).

Yes, but there weren't many tools to "correctly" compose XHTML back then.

> XML parsers are not that bad when you disable custom entities, which browsers could easily do.

Yes, but it's another thing browser developers need to think of. A lot of CVEs already originate in browser. Even if it's actually safe, people who got burnt by XML, would have bad opinions about XML in mind.

Reply on news.ycombinator.com