0

This is where I took this example from:

<a href="<?php echo $_GET['e'];?>">Back</a>

In this code, I can do http://my_url?e=javascript:alert()

But what can I do if my code is like this:

<a href="e<?php echo $_GET['e'];?>">Back</a>

1
  • 1
    what are you trying to achieve here? – yeah_well Dec 2 '20 at 13:18
0

Yes

If the data you inject is arbitrary and not filtered at all, you could inject "></a><script>alert('XSS')</script><a href="#

This will end up with the following DOM elements:

<a href="e"></a><script>alert('XSS')</script><a href="#">Back</a>
0
  • Short answer is YES, Long answer is what is your PHP script sanitizing input then what you are trying to achieve might not be displayed like you want to achieve XSS

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.