Hacker News Reader

I applied to the example here the first test I always make of any things like this: HTML injection. Result: failure. ☹

yup, my go to test name:

\_(ʘ_ʘ)_/ "'<!--/*༼ つ ◕_◕ ༽つ

caused it to show

{ "formData": { "name": "\\_(ʘ_ʘ)_/ \"'

just this will do:

<!

will show:

{ "formData": { "name": "

Thanks! Fixed. I added a "way-html" attribute (boolean, false by default) that you can pass to your DOM elements.