I thought the
\ (backslash) character was a dangerous character that you needed to filter out/properly encode to protect against XSS attacks (OWASP says so, too), and I still do, but why?
var_name = "query"
It does filter out double quotes, single quotes and semicolons, but I'm able to use things like
\r seems to just render whitespace...)
but for some reason I'm just now able to get the
alert() called successfully.
I've played around with
\n, like putting a few before and after
alert(), and also escaping the closing double quote:
var_name = "\n\nalert()\n\n\"
But nothing seems to work. I think I'm missing something obvious here, but if someone could help me out here and clarify this I'd be grateful!