Question

I ran into code about a month ago (unfortunately i couldn’t find the link to post it here) that had a standard youtube embed html code followed by

</embed>
</object>
</video>

the problem is in that code there were no opening tags. I figured the person knew what he was doing because it all worked out fine but now my curiosity got the better of me. How can there be closing tags without opening tags? If there can’t be any why isn’t the client crashing? The above was implemented using RoR 3. Thanks in advance.

Answer 1

He might have had a javascript with encrypted text, where he encrypted the opening tags.
If you find the link, I’ll tell you in details.

There might been a javascript like this:

decrypt("random string").

There might be a similar code on RoR3.

EDIT:

Example;

function encrypt($string){
    $replace = array("e", "m", "b", "d", ">", "<");
    $new = array("!", "%", "+", "-", "@", "&");
    $string = str_replace($replace, $new, $string);
    return $string;
}
function decrypt($string){
    $new = array("e", "m", "b", "d", ">", "<");
    $replace = array("!", "%", "+", "-", "@", "&");
    $string = str_replace($replace, $new, $string);
    return htmlspecialchars($string);
}
$encrypt = encrypt("<embed>");
echo $encrypt;
echo "<br>";
echo decrypt($encrypt);

outputs:

&!%+!-@
<embed>

This is done with php, thus it will make it appear clean html in the end.
If you do this with Javascript, they won’t see , but they will see

decrypt(“&!%+!-@”)

Check out the java escape function.