DataTables ↔ Server‑Side REST API: Integer Record Counts and Cell Escaping
0 reputation · 18 Dec 2025, 08:25 UTC
DataTables (client-side) ↔ Server-Side REST API
DataTables server-side processing requires a JSON payload containing draw, recordsTotal, recordsFiltered, and data. The plugin expects recordsTotal and recordsFiltered to be integers, but it does not document whether type mismatches trigger warnings or are silently ignored.
The escape option also lacks a clearly documented default for server-side rendering, leaving uncertainty about whether cell content is automatically protected against XSS.
Before changing the API contract, the integration boundary needs a defined behavior for these edge cases.
Does DataTables validate recordsTotal and recordsFiltered as integers, or does it silently coerce invalid types?
What is the documented default for escape when serverSide is true, and does it guarantee XSS safety for server-supplied cell content?
datatables