Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm scanning HTML before it reaches a browser, and I've just heard about a type of exploit that uses invalid UTF7 or UTF8 sequences to embed an otherwise invisible script tag, which is used to execute arbitrary code.

I have never seen such a sequence myself and I am curious what it looks like, so that I can do a simple strstr call to locate them.

Thanks for any help.

share|improve this question

Your first line of defence should be input sanitization. In other words, make sure that you only accept valid UTF-8 or whatever other format you are expecting.

Going the route of string replacement is based on black-listing. Black-listing is always one step behind and, because of this, won't work. Your second line of defence (after sanitizing) should be White-listing instead.

share|improve this answer
Exactly. I would like to add that, even if you would have a perfect XSS-detector, you shouldn't be filtering input anyway. What if, say, a user wants to use a < somewhere or demonstrate some Javascript? Instead you should see text and HTML as two different things; and whenever you want to include some form of text into your page, you'll have to 'convert' it to HTML (by using an escape function that only accepts UTF-8) first. – AardvarkSoup Jun 30 '12 at 21:14

Perhaps the following link will aid you:

XSS CheatSheet

It is a cheatsheet that contains a lot of XSS examples including UTF ones.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.