3 ms·
http://www.news.thejobhill.com/ajax/tag_search.php?query=test%22%3E%3Cimg%20src=https://encrypted.google.com/images/logos/ssl_logo_lg.gif%3E http://www.news.the
by mike-cardwell 16y ago
http://www.news.thejobhill.com/ajax/tag_search.php?query=test%22%3E%3Cimg%20src=https://encrypted.google.com/images/logos/ssl_logo_lg.gif%3E http://www.news.thejobhill.com/ajax/tag_search.php?query=tes...
You seem to have rudimentary protection against XSS, but it's not complete. You should escape properly. Backslashes aren't for escaping characters in html
- geekytenny 16y agoThanks mike. i always knew that could be a problem, but was a bit lax cos the results didnt stay on the site. Have a look now anyways, the google logo doesnt show anymore.