That would require escaping the HTML on the server prior to output, which is exactly what we already have (and regularly fails, even when people think they're doing it right).
The real analogue to SQL query parameter binding would be an output format that keeps the two distinct.
Comments
That would require escaping the HTML on the server prior to output, which is exactly what we already have (and regularly fails, even when people think they're doing it right).
The real analogue to SQL query parameter binding would be an output format that keeps the two distinct.
Or encoding all the text in the tag, or <noscript length=XXX>, or etc etc etc.
It's kind of a moot point since it will never happen, but it's not rocket science.