Hacker News Reader

Isn’t the correct solution to replace '<' and '>' with '<' and '>'?

The correct solution is to apply Content-Security-Policy plus character escaping as needed.

Yeah, escaping entities when rendering, using prepared statements in the database. It's not rocket science.

amen

Or, you know, using ordinary SGML validation which has the capability to block disallowed elements since 1986.