If you use inspect in the developer tools for Chrome the values for the two input boxes below will look the same.

<input name="test1" type="text" value="<script>alert('a')</script>"/>
<input name="test2" type="text" value="&lt;script&gt;alert(&#39;a&#39;)&lt;/script&gt;"/>

If on the other hand you put the elements on the page only one of these will produce an alert



Which makes sense, <script> in a textbox value doesn't mean anything

If you submit the form containing these textboxes, in the post call, test1 and test2 transmit the same data.

What specifically is happening here. Does the browser internally htmldecode the textbox value when the page arrives, or does it decode it when it's transmitted? Assuming the former, does it do this with anything else?


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.