encodeURIComponent on the "Getting started" page

[mik01aj]

Quoted from http://hapijs.com/tutorials:

handler: function (request, reply) {
    reply('Hello, ' + encodeURIComponent(request.params.name) + '!');
}

Note that we URI encode the name parameter, this is to prevent content injection attacks. Remember, it's never a good idea to render user provided data without output encoding it first!

While I agree that rendering user provided data is often a risk, I have big doubts whether the presented method it is really a good idea. It means garbling possibly valid user input such as John "Johnny" Doe or Владимирь. Shouldn't Content-Type: application/json be enough to guard against HTML/JS injection?

[nlf]

The point of the comment wasn't to showcase a perfect method of encoding, but rather to make sure that users are aware that directly rendering user provided data is a bad idea. encodeURIComponent is the simplest, most basic method of encoding such data to protect the user so that's what I used as an example. Eventually there will be a security tutorial (see #44) where we can go in to more detail about this topic.

[binarymist]

Loving it, devs that think about security :P