Browser & Web Performance · Senior · Question 51 of 75
Why is it better to encode output for its context than to filter 'bad' input once on arrival?
- 1Input filters are too slow
- ✓Correct answer: The same data may be placed in HTML text, attributes, URLs or JS, each needing a different encoding; input filters can't know where it will go
- 3Encoding is only needed for numbers
Explanation
Validate input for business rules, but escape at the point of output using context-aware templating.