Is there yet a programming language that will prevent XSS and SQL Injection.
My thoughts are something that is context aware and will correctly encode when necessary. For example, if a string is used in a call to an SQL function, it is quoted unless you tell it to not be quoted. And if you place the variable into a string that is printed, then context-aware encoding is used, knowing whether the code is found in HTML Attribute, HTML fully-formatted (with non breaking spaces and returns), or CSS, Script.
Does such a language exist? One that
- Encodes by default, unless you say otherwise,
- Includes considerations for different contexts (HTML, Script at least)
- Does all the context-aware stuff at compile time,
- It does not need to compile to bytecode. A popular high-level language will do.
You could surely take a look at OPA and Ur/Web, both of them enforce safety/security (to a varying degree).