Question

I am using Codeingiter, I see that the xss_clean() is replacing the tab characters with a single space character. This is breaking the contents that are later displayed inside <pre><code></code></pre> tags.

Can XSS attack string inside <code> HTML tag be of any problem?

If yes, is there a way to retain the tabs in such a situation?

Answer 1

Yes, XSS attacks within the <code> element are still a problem. To get around this, you should escape your code within the <code> block. e.g.

<pre><code>&lt;p%gt;this is an example paragraph in code&lt;/p&gt;</code></pre>

Which will display as:

<p>this is an example paragraph in code</p>