Hacker News Reader

I don't quite buy his argument about why we need to keep things in unsafe format for a while. If that credit card app can't handle HTML-encoded stuff, how would it handle evil javascript?

View on HN

In general, I find that it's a bad idea to destroy information. Keep all input intact as long as possible, so if you ever do encounter a problem, you don't need to reconstruct the original data. You can always process data into the correct form at runtime.

Of course, there are performance implications to this, but those can be dealt with. Encoding strings right away for performance reasons is definitely a premature optimization.

Allowing a user to edit the string later is the most common reason I've encountered.

No one likes to see an input all cluttered with """, "&" and the like.

Reply on news.ycombinator.com