A technique for avoid filtering of common words is the one I described in the title.
However, why does this technique work? SELECT isn't the same as SELSELECTECT for example.
Let's say I blacklisted the word
<script> and replace it with nothing. Then
This is why well-written html sanitizers/purifiers apply the rules recursively. That is only when the last sanitation step made no changes to the content will it stop/not apply another round of the processing rules. (It also likely will fail and return no content if too many processing rounds are necessary).
This works against broken sanitizers that simply use
s.Replace("select",""). When you apply that to
selselectect, it removes the
select in the middle, but since it doesn't run again on the output, the split
select and survives the sanitizer.
This attack won't work against any sane sanitizer.