Home/ Questions/Q 4579090
In Process

The Archive Base Latest Questions

Editorial Team
  • 0
Asked: 2026-05-21T20:35:35+00:00

Is this 100% safe against XSS? If not, can you please provide example bad

  • 0

Is this 100% safe against XSS?
If not, can you please provide example bad string text showing me why it is not.

<html>
  <body>
    <script>
      <?php
        $bad = "some bad string.  please give example text that makes the below unsafe";
        echo "var a = ".json_encode($bad).";";
        echo "var b = ".json_encode(array($bad)).";";
      ?>
    </script>
  </body>
</html>

Thanks.
Share

Leave an answer

You must login to add an answer.

Need An Account,

1 Answer

  1. Editorial Team

    In short, it’s safe. Possible XSS would require escaping from the javascript string (") or script (</script>). Both strings are properly escaped:

    "          becomes  \"
</script>  becomes  <\/script>

    This is the the part about direct injection. Your application should take in account that some array elements may be missing. Another possibility is that an array element is not the type you would expect (e.g., an array instead of a string)

    • 0