3 ms·
I know this is off-topic, but you can use eval(String.fromCharCode(XX, XX, XX, etc)) to run arbitrary JavaScript, even if quotes are escaped.
by Xuzz 15y ago
I know this is off-topic, but you can use eval(String.fromCharCode(XX, XX, XX, etc)) to run arbitrary JavaScript, even if quotes are escaped.
- Xk 15y agoThat's not the reason why people escape quotes. Imagine the case where he had not escaped quotes, but had escaped < and >. In that case, I could put a doublequote/singlequote to break out of the JSON. Then I could just put whatever javascript I wanted and run it. But that is true, trying to filter specific character sequences for example, "eval" is never a good idea.