Top all-time · #14154
sirre.al
Personal blog · sirre.alprogrammingweb
sirre.al is a personal blog at sirre.al about programming and web. Since 2021, 5 different Hacker News readers have linked it 5 times, most often “How to safely escape JSON inside HTML SCRIPT elements”. It is still writing: the last post was on 2025-08-05, and you can follow it by feed.
Too few sampled comments (3) to say how often HN recommends it.?
Why HN links it
HN commenters link sirre.al for its post on safely embedding JSON in script tags, which covers how a closing </script> tag can break a page. Comments also cite it in discussions of HTML and XHTML escaping.
Summarised by Claude from a sample of 3 HN comments that link here. Each comment is marked recommending, critical or neutral (citing without judging); how this works.
Most-linked posts?
- How to safely escape JSON inside HTML SCRIPT elements4 people · 4 mentions · first linked 2025-08-08
What Hacker News says?
About embedding JSON in a script tag, I recently read an article on the risk of a closing </script> tag within the JSON that could break it. Safe JSON in script tags: How not to break a site - https://sirre.al/2025/08/06/safe-json-in-script-tags-how-not... As with all untrusted content, depending on where the JSON string comes from, sanitizing the output is worth considering.
Comment linking /2025/08/06/safe-json-in-script-tags-how-not-to-break-a-site/
on “<template>: The Content Template element”Submitted How to safely escape JSON inside HTML SCRIPT elements as a story · 86 points
HN discussionAs if oligopolization of the browser space wasn't a deliberate objective of the WHATWG. I would rather have them deprecate the HTML syntax, which is a nightmare to parse, nightmare to escape for ( https://sirre.al/2025/08/06/safe-json-in-script-tags-how-not... ), and nightmare to securely transform (CVE-2020-26870). Now that MSIE is dead, all mainstream browsers support XHTML just fine; compared to HTML, XML is much…
Comment linking /2025/08/06/safe-json-in-script-tags-how-not-to-break-a-site/
on “Should we remove XSLT from the web platform?”Submitted Volta vs. Nvm for JavaScript Tooling as a story · 33 points
HN discussionThis is what I complain about: https://nvd.nist.gov/vuln/detail/CVE-2020-26870 https://sirre.al/2025/08/06/safe-json-in-script-tags-how-not... https://bughunters.google.com/blog/5038742869770240/escaping... None of those problems exist in XHTML.
Comment linking /2025/08/06/safe-json-in-script-tags-how-not-to-break-a-site/
on “You are not required to close your <p>, <li>, <img>, or <br> tags in HTML”