4 ms·
I certainly agree with this but I think it's misleading to say it increases your chances for xss security threats. I can see it increasing the chances of havin
by sdesol 16y ago
I certainly agree with this but I think it's misleading to say it increases your chances for xss security threats. I can see it increasing the chances of having a webpage not behave properly across all browsers though.
- mhansen 16y agoSay some "<script>do_bad_stuff();</script>" got through from some source you just expected to have text. (e.g. this happened for youtube the other day) If you insert this into the DOM with html(), it will execute the script, doing bad things. If you insert it into the dom with e.g. text(), it won't be interpreted.
- DrJokepu 16y agoYou don't even need a script tag. Any tag with event attributes will work, e.g. <span onmouseover="alert('XSS')">Hello World!</span>