Hacker News Reader

So why would a currency formatter generate HTML instead of plain text? That seems very strange to me. How does the helper know if I want to use the number in HTML, an email header or even a shell argument? Or are RoR helpers designed to be only usable directly with HTML?

PHP's number_format() doesn't escape for HTML - is that an XSS bug too?

View on HN

The view-dependent stuff is in fact separated from the business conversion logic and can be used in a non-web context if you want.

Here's the version for use in a view context: https://github.com/rails/rails/blob/master/actionview/lib/ac...

You can see that this method has some XSS prevention logic.

Here's the converter itself: https://github.com/rails/rails/blob/master/activesupport/lib...

Reply on news.ycombinator.com