Simon Willison’s Weblog

15th April 2007 - Link Blog

Most HTML templating languages are written incorrectly. “If you ever find yourself in the position of designing an html template language, please make the default behavior when including variables be to HTML-escape them.” I couldn’t agree more.

Posted 15th April 2007 at 8:28 pm

Recent articles

Publishing WASM wheels to PyPI for use with Pyodide - 13th June 2026
Claude Fable is relentlessly proactive - 11th June 2026
Initial impressions of Claude Fable 5 - 9th June 2026

This is a link post by Simon Willison, posted on 15th April 2007.

daniel-martin 1 security 609 templating 7 xss 60

Monthly briefing

Sponsor me for $10/month and get a curated email digest of the month's most important LLM developments.

Pay me to send you less!

Sponsor & subscribe