Sign Up to our social questions and Answers Engine to ask questions, answer people’s questions, and connect with other people.
Login to our social questions & Answers Engine to ask questions answer people’s questions & connect with other people.
Lost your password? Please enter your email address. You will receive a link and will create a new password via email.
Please briefly explain why you feel this question should be reported.
Please briefly explain why you feel this answer should be reported.
Please briefly explain why you feel this user should be reported.
I’m sure that the answer to this question is No, but I can’t seem to find a way that simply transforming < and > to < and > doesn’t completely block reflected and persistent XSS.
I’m not talking about CSRF.
If this doesn’t block XSS, can you provide an example of how to bypass this defence?
When using an untrusted string in an attribute (quoted with
") you need to escape"as".Otherwise you could easily inject javascript. For example,
<a href="{{str}}">withstrbeing, for example," onmouseover='something-evil'".