I'm aware that filtering strings doesn't go this way, but when encoding xss payloads into json format in php and storing that information temporary in classes, the result in the browser, it will show all the strings that are before the javascript content, the payload in the middle won't execute since i use json_encode for all the strings and all what is after the javascript content is not displayed in the browser. but can i use this in real world applications?

I use a picture to read with more comfortability

  • Please include your code as text snippet. – Samuel Philipp Jul 26 at 5:39
  • +Samuel Philipp But if i do that it will create confusion in the last line, the colors show the diffrence – user211258 Jul 26 at 5:46
  • I'm not sure what you're asking about, can you clarify? :) – Artog Jul 26 at 12:10
  • Seems like this same question is answered in stackoverflow.com/questions/12062146/…. Can't mark this question a duplicate because it's in another stack exchange forum. – Buffalo5ix Jul 26 at 17:17
  • @Artog I want to know if it is a stable/secure method to plague attackers in the sense if the effect is similar to sanitizing, while it is not a method at all. – user211258 Jul 27 at 14:48

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy