3 ms·
Hey there mate. I'm the one who was linking to the Underscore.js annotated escape function: http://documentcloud.github.com/underscore/docs/underscore.html#sec
by cmwelsh 14y ago
Hey there mate. I'm the one who was linking to the Underscore.js annotated escape function:
http://documentcloud.github.com/underscore/docs/underscore.html#section-118 http://documentcloud.github.com/underscore/docs/underscore.h...
If you use something like this when displaying messages, it should not allow any XSS.
- ecto 14y agoThat is a very tall claim :) Thanks though, I'll read the code!
- cmwelsh 14y agoAlso you need to watch out for Unicode control characters messing everything up! Certain characters (up to you to figure out which) should actually be stripped as they have no useful function for Western languages...