Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Is there a way to bypass escape function in javascript for exploiting a XSS vulnerability ?

share|improve this question
What do you mean by ‘bypassing escape function in JavaScript’? – Gumbo Nov 29 '11 at 8:58
If you're asking if there's a way to make the escape() function behave differently from how it is intended then this would likely amount of a browser specific vulnerability – Andy Smith Nov 29 '11 at 9:49
I don't think you understand what an XSS vulnerability is. Its not a problem with JavaScript, its a problem with the server side code. (Except for dom based xss, but whatever.) – rook Nov 29 '11 at 18:34

Sure, lets say you have the following PHP code that is vulnerable to XSS:

print "<script>var t=escape('".$_GET['t']."')</script>";

You can supply this file with the following XSS Prof of Concept to get an alert window:


share|improve this answer

If you need to override the escape function for whatever reason (I am assuming an already persistent XSS?) I am pretty sure you can override it by creating an anonymious function similar to this:

(function() {
   window.escape = function() {
      return true;

If however you are looking for general bypassing XSS filters I recommend reading and trying this XSS cheat sheet:

share|improve this answer
window.escape = encodeURIComponent; – Mike Samuel Dec 27 '11 at 18:52

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.