Anyone that’s ever created a form, comment section, or search box using JavaScript will have had to show something that a user typed on a web page. Well, it seems like a no-brainer, but one thing I’d like to stress is that you should never use user input as HTML, unless you have a good…

A WordPress website can have dynamic content, like the post title, username, links, and custom fields, or form values. If this information is integrated into a page without proper escaping it can cause security issues, such as cross-site scripting (XSS). There are different functions that WordPress has under its own banner which can help developers…

The difference between HTML escaping and sanitization—in these sometimes-confusing contexts. Introduction HTML escaping and HTML sanitization are two important techniques for protecting websites from cross-site scripting (XSS) attacks. Both offer some protection against the existence of unsafe content that has the potential to pose a security issue, yet both offer different solutions, and in different…

Malformed JSON in AI-Generated responses can be tackled through a few techniques. AI can create valuable code, data, summaries and auto-responses in seconds. But if you ask for some json from an AI-model, it isn’t always a valid json. Missing quotation marks, after-punctuation commas, extraneous text after the JSON object, invalid character types (unescaped quotes…