Mixing Vue.js templates with server-side templates can lead to XSS
Look, I am gonna be blunt.<p><i>A great man once said: &quot;Those who sacrifice essential Security to purchase a little temporary Convenience deserve neither&quot; :)</i><p>I have seen Javascript  frameworks and fads come and go. I remember 10 years ago &quot;progressive enhancement&quot; was the greatest thing, and onclick inside your HTML was considered hideous. Then came Angular with its ng-click and suddenly placing behavior stuff inside declarative HTML was cool again. Then came React and placing HTML -- er, excuse me, JSX inside your Javascript files was ... shocking but then cool. Then came Vue...<p>Look, it isn&#x27;t that difficult:<p><pre><code>  HTML is for structure
  CSS is for presentation
  JS is for dynamic behavior
</code></pre>
Want animations? Use classes and CSS.<p>Want complex behavior? Use classes, find your elements with getElementsByClassName and do your thing.<p>Want extra info? Stuff it into a JSON-encoded data-{something} attribute.<p>There is no reason to let your declarative HTML contain code-like things. Have it contain markers using HTML-compatible things like CSS classes and data- attributes (we used to call this &quot;microformats&quot;).<p>Then on the server...<p>When you render your HTML tags you escape your attributes and text content.<p>When you output Javascript ... you DON&#x27;T. Instead you json_encode stuff that a .js file should consume. Oh, and use SRIs when loading the js from CDNs.<p>Before you execute SQL, you escape the values.<p>======================<p><i>In short - you escape for the medium you are interacting with.</i><p>======================<p>Seriously, it&#x27;s straightforward and you can&#x27;t mess it up... unless you start using &quot;syntax sugar&quot; that makes you insert things into a language that it wasn&#x27;t designed for, after reading a framework touting &quot;LOOK THE GREATEST SHINY NEW NONSTANDARD TECHNIQUE&quot;.<p>It&#x27;s really not adding all that much. I remember when two-way binding was hot and touted by Angular 1. It&#x27;s not anymore. I remember when CoffeeScript was the next greatest thing. It&#x27;s not so much anymore.<p>Meanwhile, if you stick to the ES5&#x2F;6 standards and let each language of the Web do what it&#x27;s supposed to, you have a great future ahead of you. And much less injections to worry about.<p><i>Update - to the downvoters: go ahead, type words! I am interested to have an actual discussion after over 15 years of seeing SO MANY SECURITY HOLES from this one thing: frameworks interpolating stuff into a language that was designed for something else.</i>