Making Wrong Code Look Wrong (2005)

Most modern typed languages support encoding this information in the type of the variable, so that the compiler catches it, instead of in the variable name. Alexis King wrote a blog post about it that reached the front page a few days ago. https://lexi-lambda.github.io/blog/2019/11/05/parse-don-t-va...

If you want even better escaping safety: use different types for safe vs unsafe strings. You should not ever be crossing the streams. So make it a compile-time failure. And anywhere you truly do know better, you can just use a transformation func like `safe = iKnowWhatImDoingCompilerSTFU(unsafe)` And keep in mind that "escaping" is not a binary. Something that works in an HTML node's body may not work in an attribute or a request header or a URL. This is…

The modern solution to this problem is to use different types for semantically distinct categories, even if the in-memory representation is effectively identical. Noticing that you’re mixing HTML-safe and HTML-unsafe strings is exactly the sort of thing the compiler should be able to help you with.