Hacker News Reader

Base64 encode a string and it's generically sanitized. They're a bit difficult to read with the naked eye though.

Unless it's in a URL. (This is why URL-safe Base64 versions exist... Which can then in turn be inappropriate for other places.)

And base64 can use the / character, so it's unsafe for POSIX filenames.

Until the next element in the pipeline chain decodes it and you can then have injection.