Ask PG: Why is HTML-like text stripped from titles? Why can't be used? | Hacker News Reader

Ask PG: Why is HTML-like text stripped from titles? Why can't be used?

The title was "Ask PG: Why is HTML-like text stripped from titles? Why can't <angle brackets> be used?", but the "<angle brackets>" bit was were stripped, so I had to rewrite it without it.

View on HN

Odds are, it's to avoid Cross Site Scripting attacks.

http://en.wikipedia.org/wiki/Cross-site_scripting https://www.owasp.org/index.php/Cross-site_Scripting_(XSS)

That makes no sense. It is trivial to use HTML entities (< and >) here. In fact, I think this is already done for comments.

Test: <>

Edit:

  <p>Test: &lt;&gt;</font></span>

Yep.

Why would you want to use HTML-like text in titles anyways?

HTML itself is unusual, but > and < do appear sometimes, and the fact they're stripped can make titles cease to make sense.

We have three other types of brackets in standard ASCII that you can use for the same purpose within a headline. :P

And then there are titles like "70 Unique Ways to Encode ＜" which have to use a unicode workaround: https://news.ycombinator.com/item?id=6864186

Reply on news.ycombinator.com