Simon Willison’s Weblog

15th April 2007 - Link Blog

Most HTML templating languages are written incorrectly. “If you ever find yourself in the position of designing an html template language, please make the default behavior when including variables be to HTML-escape them.” I couldn’t agree more.

Posted 15th April 2007 at 8:28 pm

Recent articles

Qwen 3.8 27B on my laptop can interpret model weights, too - 3rd November 2026
The U.S. Census Bureau and “Super Intelligence” - 2nd November 2026
The October inflection point for vibe game development - 28th October 2026
Battle Drones - a vibe coded RTS with audio-based multiplayer - 20th October 2026

This is a link post by Simon Willison, posted on 15th April 2007.

daniel-martin 1 security 642 templating 7 xss 61

Monthly briefing

Sponsor me for $10/month and get a curated email digest of the month's most important LLM developments.

Pay me to send you less!

Sponsor & subscribe