Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I know XSS is possible if the is echoed onto the page, but from my understanding, this requires you to use an iFrame, but what if the page has clickjacking protection, stopping the page from being embedded in an iFrame? Is such an attack still possible? Here's example JQuery...

share|improve this question
up vote 3 down vote accepted

The other way to get hold of another window is to pop it up. You can specify the window name in the second parameter:

var victim='', '<script>alert("boom");<\/script>');
share|improve this answer

The method .text() seems more adequate/safer to solve the functional requirement of echoing the in the page DOM.


from jquery docs:

We need to be aware that this method escapes the string provided as necessary so that it will render correctly in HTML. To do so, it calls the DOM method .createTextNode()

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.