Say, I have a page where the input from the user is taken and is passed through a simple client-side XSS filter. That filter only replaces <
characters with ''.
in = in.replace(/[<]/g, '');
The input is then passed on to JQuery's html()
method in order to embed the user input inside a <div>
tag.
How can we bypass this simple XSS filter?