Reputation
1,019
Top tag
Next privilege 2,000 Rep.
Edit questions and answers
Badges
1 9 18
Newest
 Yearling
Impact
~65k people reached

Apr
17
awarded  Yearling
Mar
7
awarded  Famous Question
Oct
26
awarded  Popular Question
Jul
25
awarded  Constituent
Jul
21
awarded  Caucus
Dec
11
awarded  Yearling
Sep
3
awarded  Good Question
Aug
28
awarded  Notable Question
Jul
31
awarded  Popular Question
Jul
2
awarded  Curious
Feb
4
comment OWASP escaping recommendation - why /?
Thanks for the link to minimal rules. They make much more sense, actually.
Feb
4
comment OWASP escaping recommendation - why /?
No, it's not analogous, because / has meaning in that context, while in original context it does not, and that was the point of the question!
Feb
4
comment OWASP escaping recommendation - why /?
@FalconMomot in general, it is, but adding random characters to escape list just doesn't make sense. Why won't they then suggest to add letter Z to the list? Just to be cautious, maybe it's dangerous too. It just looks completely random, sorry.
Feb
4
comment OWASP escaping recommendation - why /?
This recommendation is specifically for content outside elements, not for attributes. For attributes they recommend completely different handling, see the next item after the one I have linked.
Feb
4
comment OWASP escaping recommendation - why /?
Well, then they should suggest escaping pretty much any non-alphanum character, since most of them have significance in some context. They don't do it. They correctly identify the characters that may be significant in HTML, but then add / which is not. Also, you can not inject <br/> since < and > are encoded, so you could inject only &lt;br/&gt; - what's wrong with that?
Feb
3
asked OWASP escaping recommendation - why /?
Jan
23
awarded  Nice Answer
Jan
20
comment Reasonable way to store encrypted passwords in a webapp's database, Linux
I've asked similar question a while ago: security.stackexchange.com/questions/1335/…
Jan
20
comment Reasonable way to store encrypted passwords in a webapp's database, Linux
mysql supports working over SSL.
Dec
11
awarded  Yearling