2 ms·

so in other words, facebook is kind of dumb for allowing remote javascript execution...

• nodesocket 15y ago
  Well, it can be tricky, often times the XSS attack is masked quite deeply, but there are known methods. PHP strip_tags will assist, though would need to be beefed up a bit to handle the onclick, onhover, onblur, onfocus, etc events. In this particular case, simply looking for `javascript:` would have done the trick.