3 ms·
You need to escape =. Otherwise if someone does something like: document.write("<a class=" + str + " href='foo'>xss</a>"); The attacker can set str to "foo on
by extrapickles 9y ago
You need to escape =. Otherwise if someone does something like:
document.write("<a class=" + str + " href='foo'>xss</a>");
The attacker can set str to "foo onclick=alert(1)".
- jwilk 9y agoYou should put quotes around the attribute value. Then you won't need to escape =.
- extrapickles 9y agoThe issue is when a developer forgets to do so. No reason to not escape it.
- TazeTSchnitzel 9y agoYou can't safely put arbitrary user input in an unquoted attribute value.