3 ms·
I think escaping quotes only matters for attributes (which can use ' or "). Example: <img src="$url"> Exploit: foo.jpg" onload="alert('pwned')
by jscissr 8y ago
I think escaping quotes only matters for attributes (which can use ' or ").
Example:
<img src="$url">
Exploit:
foo.jpg" onload="alert('pwned')
- kuroguro 8y agoHeh, found the exact bug on a live bbcode parser some 5 years ago.
- codedokode 8y agoIt was probably written using regexps? One should make full syntax analysis instead of writing regexp hacks.