HTML built or escaped by hand: innerHTML from values, .replace('<', '&lt;')

Shortcuts that trade away safety: one of the ways AI coding agents bloat software, from lessloc's pattern catalog. lessloc catches it as unsafe: use textContent or the framework's rendering.

What makes HTML built or escaped by hand a bad practice?

The standards that call it a bad practice: CWE-79 Cross-site Scripting; CWE-116 Improper Encoding or Escaping of Output.

What does lessloc do about HTML built or escaped by hand?

lessloc catches it as unsafe: use textContent or the framework's rendering.

• unsafe (tier 1): A shortcut that trades away safety: SQL built from values, HTML built or escaped by hand, Math.random() for secrets, a fast hash for passwords, certificate checks turned off, text run as code.

Examples

Caught as unsafe:

export function show(el, name) {
  el.innerHTML = `<b>${name}</b>`;
}

Written well:

export function show(el, name) {
  el.textContent = name;
}

Related patterns

Hand-written versions of what the platform does safely. They are short, which is why agents reach for them. The other patterns in Shortcuts that trade away safety:

• SQL built from values instead of query parameters: lessloc catches it as unsafe: pass values as query parameters.
• Math.random() or random for tokens and passwords: lessloc catches it as unsafe: crypto.randomUUID(), getRandomValues() or the secrets module.
• Fast hashes (MD5, SHA-1, SHA-256) for passwords: lessloc catches it as unsafe: bcrypt, scrypt or argon2.
• Certificate checks turned off: lessloc catches it as unsafe.
• Running text as code: eval, exec, new Function: lessloc catches it as unsafe: parse the input instead.