javascript tricks

Encoding data for POST requests

Right now, when you go to copilot.github.com you’re greeted with this example: This is bad and might result in security issues. Here’s where things go wrong: body: `text=${text}`. Unescaped text is added into a format with defined encoding. It’s similar to SQL/HTML injection, as something intended as a ‘value’ gets to interact with the format directly. Read more…