Ask PG: Why is HTML-like text stripped from titles? Why can't be used?

1 points by TazeTSchnitzel 12y ago ↗ HN

The title was "Ask PG: Why is HTML-like text stripped from titles? Why can't <angle brackets> be used?", but the "<angle brackets>" bit was were stripped, so I had to rewrite it without it.

6 comments

[ 3.5 ms ] story [ 24.4 ms ] thread

minimaxir 12y ago ↗

Why would you want to use HTML-like text in titles anyways?

TazeTSchnitzel 12y ago ↗

HTML itself is unusual, but > and < do appear sometimes, and the fact they're stripped can make titles cease to make sense.

minimaxir 12y ago ↗

We have three other types of brackets in standard ASCII that you can use for the same purpose within a headline. :P

TazeTSchnitzel 12y ago ↗

And then there are titles like "70 Unique Ways to Encode ＜" which have to use a unicode workaround: https://news.ycombinator.com/item?id=6864186

YoAdrian 12y ago ↗

Odds are, it's to avoid Cross Site Scripting attacks.

http://en.wikipedia.org/wiki/Cross-site_scripting https://www.owasp.org/index.php/Cross-site_Scripting_(XSS)

TazeTSchnitzel 12y ago ↗

That makes no sense. It is trivial to use HTML entities (< and >) here. In fact, I think this is already done for comments.

Test: <>

Edit:

  <p>Test: &lt;&gt;</font></span>

Yep.