This is pretty cool, but at the same time i'm horrified that somebody might walk away thinking you need to deny these requests to protect against XSS or SQL injection.
Maybe i want to sell coffee mugs with `<img src=x onerror=alert(document.domain)>` on them.
Parse, dont validate. (And never interpret what shouldn't be)
Maybe i want to sell coffee mugs with `<img src=x onerror=alert(document.domain)>` on them.
Parse, dont validate. (And never interpret what shouldn't be)