From: Jeff D. <da...@da...> - 2002-02-21 15:31:23
|
Adam Shand said: >> Yes it is, but... The whole point of the comment syntax is that the >> comments don't get sent to the browser. That makes it hard to do >> anything malicious with them. > > ah, i was orgininally thinking that we could just enable the comment > html tag and let it pass through to the browser since it won't be seen. > it didn't occur to me that there was a simpler alternative :) Ooh. We could do that, too. Still not a problem, I think, as long as the comment text is htmlspecialchar()ed ('<' -> '<'). |