JS code
var id = $(this).data("id");
$.get("/api.php",{id:encodeURIComponent(id)}).done(function(data){
$('<div>'+data+'</div>').appendTo('.parent');
});
api.php:
echo json_encode('<h1>Hi username!<h1><p>text</p>',JSON_HEX_TAG | JSON_HEX_APOS | JSON_HEX_QUOT | JSON_HEX_AMP);
Returned HTML content is not from a user. It is already written in api.php
Is this query XSS vulnerable? I heard html()
is evil. What about appendTo()
?
switch ($id)
in api.php. Only 1 var that I get fromdata attr
– Swing Apr 5 '18 at 11:03