I'm scanning HTML before it reaches a browser, and I've just heard about a type of exploit that uses invalid UTF7 or UTF8 sequences to embed an otherwise invisible script tag, which is used to execute arbitrary code.

I have never seen such a sequence myself and I am curious what it looks like, so that I can do a simple strstr call to locate them.

Thanks for any help.


Your first line of defence should be input sanitization. In other words, make sure that you only accept valid UTF-8 or whatever other format you are expecting.

Going the route of string replacement is based on black-listing. Black-listing is always one step behind and, because of this, won't work. Your second line of defence (after sanitizing) should be White-listing instead.

  • 1
    Exactly. I would like to add that, even if you would have a perfect XSS-detector, you shouldn't be filtering input anyway. What if, say, a user wants to use a < somewhere or demonstrate some Javascript? Instead you should see text and HTML as two different things; and whenever you want to include some form of text into your page, you'll have to 'convert' it to HTML (by using an escape function that only accepts UTF-8) first. – AardvarkSoup Jun 30 '12 at 21:14

Perhaps the following link will aid you:

XSS CheatSheet

It is a cheatsheet that contains a lot of XSS examples including UTF ones.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.