Simon Willison’s Weblog

15th April 2007 - Link Blog

Most HTML templating languages are written incorrectly. “If you ever find yourself in the position of designing an html template language, please make the default behavior when including variables be to HTML-escape them.” I couldn’t agree more.

Posted 15th April 2007 at 8:28 pm

Recent articles

The October inflection point for vibe game development - 28th October 2026
Battle Drones - a vibe coded RTS with audio-based multiplayer - 20th October 2026
Hello Python 3.15, goodbye 3.10, and now I can use 3.11 - 12th October 2026
A new feature for my blog, built using my voice - 9th October 2026

This is a link post by Simon Willison, posted on 15th April 2007.

daniel-martin 1 security 642 templating 7 xss 61

Monthly briefing

Sponsor me for $10/month and get a curated email digest of the month's most important LLM developments.

Pay me to send you less!

Sponsor & subscribe