No. It is not.
You should be escaping the content in relation the context it is present in.
So, let's suppose the variable is printed on:
<p>Where should I spam you? <input type="email" value="tasha@email" /></p>
tasha@email is the attacker-controlled parameter.
Since we are in a html context inside a double-quoted parameter of a html tag, we should be escaping all
& Other characters like '
<' or '
>' might be escaped as well but on this specific case are not required.
Please note that we are escaping characters if you are inserting bytes you should take into account that you are not inserting invalid bytes that nullify the closing
I think what they mean is that they change
\", which is the wrong escaping.
If we were in a string context inside, we could escape a
" by prepending a backslash, but here we are inside html.
An easy way to show it would be to use single quotes instead of double, but let's pretend your developer also put a backslash in front of them. Well, there are other ways:
<p>Where should I spam you? <input type="email" value="tasha@email\"><script>window.location=Array(104,116,116,112,115,58,47,47,115,101,99,117,114,105,116,121,46,115,116,97,99,107,101,120,99,104,97,110,103,101,46,99,111,109,47,113,47,50,49,49,53,56,52,47,52,57,52,56,57).map(x=>String.fromCharCode(x)).join(String())</script>" /></p>
The "escaped" quote is actually not escaped inside the context it is in, and is closing the parameter. Then the
><script> (which are not filtered) let us enter a script tag, and we are using an array to set a string without explicitly typing it as such.
Thus we are showing the website to be insecure and the approach of the developer to be completely wrong.
Note 1: Some browsers try to detect XSS attempts and disable them. This doesn't mean that the application isn't vulnerable, just that it is somewhat harder to exploit. Note that (a) Clients using other browsers are still vulnerable (b) Generally, the application will still vulnerable even in those browsers, although bypassing the filter would needs extra work, and the error is still the same: the original failure of the application to properly validate the parameters.