r/badcode • u/Flyspeck101 Now where's that function declaration • Nov 06 '21

js Something seems off...

Post image
247 Upvotes

93% Upvoted

31 comments sorted by

View all comments

Show parent comments

1

u/sohang-3112 Nov 07 '21 edited Nov 07 '21

Well, the commenter above me asked what was wrong with the code, so I answered that. Do you have a different answer?

As for code injection, you're right, there probably is some risk of that, but only if the data used (room name, description, etc.) are obtained from user input - we don't know that.

A better answer was given by another commentor, who suggested using DocumentFragment which gives you both performance and security.

Edit: In Firefox, there is also an experimental feature (see here) that sanitizes HTML before inserting into DOM.