4 ms·

This one is fixed :)

• nbpoole 16y ago
  It actually isn't. This example won't execute on page load, but it will if someone clicks in the search box. http://fluin.com/?search=Search%22%20onclick=alert%28document.cookie%29%20onfocus=%22 http://fluin.com/?search=Search%22%20onclick=alert%28documen... Since you're using PHP, I recommend you use a function like htmlspecialchars here rather than whatever kind of filtering you're doing.