3 ms·
"e.g. I can echo any evil input if my character encoding is enforced and HTML special chars are escaped as entities." FAIL :-P AFAIK You need to JS escape any
by Swannie 16y ago
"e.g. I can echo any evil input if my character encoding is enforced and HTML special chars are escaped as entities."
FAIL :-P
AFAIK You need to JS escape anything that goes into a JS context too.
- Xurinos 16y agoAnd if you send that data from JS to the server, you cannot rely on the theory that JS massaged that data first.
- pornel 16y agoYou're right - escaping is very dependent on context, and sometimes you need to escape data multiple times in nested contexts. In inline script you need to get JS string escaping right and avoid </ sequence that ends HTML CDATA.