Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I was wondering if appending a double quote at the end of a query is considered a valid XSS filter. Let's say we have a search function and I entered:

"><script>alert('hi')</script>

If I look at the source of the resulting query I will see the following:

<input name="search" type="text" value=""><script>alert('hi')</script>">

The double quote will be appended automatically at the end of my query.

Assuming that the filter also scrubs out the null char, and HTML comments <!--, would this be an effective XSS filter or is this just wishful thinking?

share|improve this question
    
What html tag are you injecting into? –  Rook Mar 23 '13 at 18:30
    
sorry my code did not show properly, thanks to Lekensteyn for editing :) –  Alistair Mar 23 '13 at 18:33
    
the alert box above should execute... did you try this before posting? –  Rook Mar 23 '13 at 18:37
    
Ok, now I got it to work :) And thank you for the reply as well! –  Alistair Mar 23 '13 at 18:45
add comment

1 Answer

up vote 2 down vote accepted

I can think of no condition in which this would mitigate XSS. If an attacker supplies <script>alert(1)</script> the result will be: <script>alert(1)</script>" which will still execute.

Further more, an attacker can just comment out the double quote in javascript: alert(1)//"

You don't need an html comment to build valid html:

<input name="search" type="text" value=""><script>alert('hi')</script><input name="inject">

You should read the XSS prevention cheat sheet, XSS is extremely common and you shouldn't come up with home-brew solutions to well known problems.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.