Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

problem is that it doesn't reflect how browsers parse things. if you were using this in a security context, e.g., here's an example it won't detect (granted this is not technically valid, but does it matter?):

<div "> put arbitrary html here as you please (using single quotes for attributes)<div ">



Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: