Is it possible to bypass an XSS filter that replaces the malicious characters? I've prepared this filter:
searchTextField.replace(/</g, " ")
.replace(/>/g, " ")
.replace(/"/g, " ")
.replace(/'/g, " ")
.replace(/=/g, " ")
.replace(/0\\/g, " ")
.replace(/\\/g, " ")
.replace(/\//g, " ")
.replace(/ +/g, " ");
The output appears inside span tag like <span>TextHere</span>
. My simple question: Can it be bypassed?