Hacker News Reader

JavaScript in the body of the message box executes 0.o very cool none-the-less.

Only for you, it gets filtered before going over the wire. Have fun :)

Should still be sanitizing user input, there's no reason to be passing the message as an html variable in handlebars {{{message}}} :/

You trust your server-side sanitization that much?

Do you trust the client side at all?

I trust handlebars with all my user inputs.