Tagged Questions

1
vote
2answers
467 views

HTML encoding to protect against XSS

While going through some references about protection against XSS i found that it is a good practice to encode data (entered by users) before using it to generate a dynamic page. I was not able to find ...
1
vote
2answers
152 views

Breaking out of attribute in double quotes

I have a piece of code that allows for [url]someurl[/url] BB-Code and replaces it with <a href="someurl">someurl</a> It takes two precautions to prevent XSS. It replaces ...
2
votes
2answers
2k views

Is this JSON encoding vulnerable to CDATA injection?

I ran across an odd notation in the jsfiddle.net generated pages <script type='text/javascript'>//<![CDATA[ $(window).load(function(){ $('form, table').animate({ opacity: 1 }); ...
3
votes
1answer
2k views

URLEncode vs HTMLEncode for XSS prevention

I have one project (in Java) that the programmer used URLEncode to output content as part of HTML instead of HTMLEncode. What is the risk that it is XSS vulnerable? (Let’s forget that it’s different ...