...element. So don't do this: text The browser will think you wrote invalid HTML by accident, and will sometimes reorder elements silently. There is one notable exception: It's...

...OK to wrap block elements in a tag in HTML5 (not 4). The spec says: The a element may be wrapped around entire paragraphs, lists, tables, and so forth, even...

When requests arrive at the application servers simultaneously, weird things can happen. Sometimes, this can also happen if a user...

...sync vs. async control flow Talking to synchronous (or "blocking") API print('script start') html = get('/foo') print(html) print('script end') Script outputs 'script start', (long delay), '...

...', 'script end...

...Talking to asynchronous (or "evented") API print('script start') get('foo', done: function(html) { print(html) }) print('script end') Script outputs 'script start', 'script end', (long delay), '...

Properties of sync...

...we want to hide via CSS and fill using JS = form.file_field_tag(:invoice, html: { class: 'visually-hidden' }) # You may also use CSS classes, of course %span(file-input-name...

...stored in ~/.config/mimeapps.list (and sometimes ~/.config/*-mimeapps.list). Further reading Stop sipgate softphone from opening html files on click

To have your text input field pre-filled in with some text that disappears as soon as the user selects...

You know Firebug as a Firefox extension but there is also a "Lite" version which runs purely off JavaScript.

When you encouter an unsafe string that you actually made html_safe before, perhaps you called one of the following methods on it: "capitalize", "chomp", "chop", "delete", "downcase", "gsub", "lstrip...

...it will correctly display the expected context: @@ -24,7 +24,7 @@ def tickets_as_html # <=== Now correct ApplicationController.render( "tickets/index.html.haml", layout: "tickets", - assigns: { tickets: tickets } + assigns: { tickets: tickets, event_name: event...

...as it is given. Behavior of "boolean attributes" remains unchanged No Haml value => no HTML value Boolean Haml value => attribute is rendered depending on that value All other values => rendered...

Haml HTML generated by Haml 5 & 6 %button(disabled) %button(disabled=true) %button(disabled=false) %button(disabled=nil) %button(disabled='123') Other attributes will be handled differently by Haml...

Also, sanitizing user input for CSS injection is much harder than sanitizing HTML...

The DB schema is the most important source of truth for your application and should be very self-explanatory. If...

HTML sanitizer by the wonko.com guy...

SlickMap CSS is a simple stylesheet for displaying finished sitemaps directly from HTML unordered list navigation...

If you have several submit elements (inputs or buttons with type="submit") that each cause different things to happen (e.g...

When you load a with a nonce, that script can await import() additional sources from any hostname. The nonce is propagated automatically for the one purpose of importing more scripts. This is not related to strict-dynamic, which propagates nonces for any propose not limited to imports (e.g. inserting elements). Example We have a restrictive CSP that only allows nonces: Content-Security-Policy: default-src 'none'; script-src 'nonce-secret123' Our HTML loads script.js using that nonce: Our script.js imports other.js without a nonce: let other = await import('other.js') console.log("Look, script.js has imported %o", other) The import succeeds without a nonce, due to implicit nonce propagation. Why this is useful In modern build pipelines, code splitting (chunking) is implemented using dynamic imports. Nonce propagation allows us to use automatic chunking with restrictive, nonce-based CSPs without using strict-dynamic. E.g. esbuild automatically groups dynamically imported modules into chunks, and writes that chunk to disk. The compiled build has an await import('assets/chunk-NAXSMFJV.js'). There's no way to inject a nonce into that import(), but implicit nonce propagation still allows the request. Should I worry about this? It would require some truly strange code for user input to make it into an import() argument. I wouldn't lose sleep over this. Is this a browser bug? It is by design. Here are some sources: HTML Spec Section 8 (Web Application APIs) (search for "descendant script fetch options") Chromium test ensuring none propagation Firefox bug implementing nonce propagation CSP issue: Someone concerned about propagation being a vulnerability CSP issue: Proposal for import-src that went nowhere Are other CSP sources also propagated? No, only nonces. In particular host-based CSPs do not propagate trust. For example, you only allow scripts from our own host (no nonces): Content-Security-Policy: default-src 'none'; script-src 'self' Our HTML loads script.js from our own host: Our script.js imports other.js from a different host: let other = await import('https://other-host.com/other.js') This fails with a CSP violation: Executing inline script violates the following Content Security Policy directive 'script-src 'self''

This thing leaves any other tag-completion method I have ever seen for HTML in the dust. It's light-years beyond anything else I've witnessed -- and autocompletion is...

...substitute for checking the actual rendering in real clients. Make sure you follow Designing HTML Emails...

...related matchers like toBeVisible() or toHaveCss(css) It gives you a function to load HTML from fixture files. Without this you would have to manually add elements to and clean...

Write your app using HTML, CSS or JavaScript, upload it to the PhoneGap Build service and get back app-store ready apps for Apple iOS, Google Android, Windows Phone...

...that converts the artwork and animation contained in Adobe® Flash® Professional (FLA) files into HTML. This allows you to reuse and extend the reach of your content to devices that...

You know that layouting HTML e-mails is terrible. For more fun, check Litmus' list of top 10 e-mail developments of 2015 that did not make things better...