New answers tagged session-fixation
Your content is going into an HTML attribute, encoded in a URL. That gives you two possible forms of encoding: URL-encoding: %2F. Although this should in principle work, both IIS and Apache block the use of URL-encoded slashes due to some past security issues. HTML-encoding: /, or rather as it is itself in a URL, %26%2347%3B. (Although... since ...
Try URL encoding the / character with the hex representation %2F.
Top 50 recent answers are included