3 ms·
Escaping <>"' properly is still enough. Without them you can't create the <script> needed to use a backtick.
by TazeTSchnitzel 9y ago
Escaping <>"' properly is still enough. Without them you can't create the <script> needed to use a backtick.
- extrapickles 9y agoYou need to escape =. Otherwise if someone does something like: document.write("<a class=" + str + " href='foo'>xss</a>"); The attacker can set str to "foo onclick=alert(1)".
- jwilk 9y agoYou should put quotes around the attribute value. Then you won't need to escape =.
- extrapickles 9y agoThe issue is when a developer forgets to do so. No reason to not escape it.
- TazeTSchnitzel 9y agoYou can't safely put arbitrary user input in an unquoted attribute value.
- chrismorgan 9y agoRemember & as well. Inside an attribute value: use single or double quotes, then escape ampersand (&) and the other type of quote (" or '). In a text value: all you need to escape are less than (<) and ampersand (&). In any other location: … why are you doing this? (<>"'& is enough to cover everything, but you probably shouldn’t be doing this in the first place.)