4 ms·

The first one doesn't escape single quotes or slash, but I have no idea how to get any HTML parser to treat just those as anything but text. Underscore's implem

• codedokode 8y ago
  Slash doesn't need to be encoded. Only 5 characters that have special meaning have to be encoded (&, <, >, " and ').
  • hawkice 8y ago
    Which raises the best question: how would you exploit someone not escaping single quotes? I do not know. Perhaps it isn't possible.
    • jscissr 8y ago
      I think escaping quotes only matters for attributes (which can use ' or "). Example: <img src="$url"> Exploit: foo.jpg" onload="alert('pwned')
      • kuroguro 8y ago
        Heh, found the exact bug on a live bbcode parser some 5 years ago.
        • codedokode 8y ago
          It was probably written using regexps? One should make full syntax analysis instead of writing regexp hacks.