mde / ejs

Embedded JavaScript templates -- http://ejs.co
Apache License 2.0
7.7k stars 841 forks source link

Do you think we should change <%- %> to something else for disabling escaping in templates? #679

Closed Benasin closed 2 years ago

Benasin commented 2 years ago

I know that using hyphen instead of equal sign will disable escaping for the content inside. However, the fact that hyphen (-) sign and equal (=) sign are next to each other on the keyboard, there will be a high chance developers will mistype and pose an XSS risk in their applications.

mde commented 2 years ago

This convention has existed for a very, very long time in all previous implementations of EJS, and versions of its precursor, ERB, for the Ruby language. There is unfortunately zero possibility we will change this.