The title pretty much says it all. It seems counter-intuitive to escape inside a <noscript> block because any js that an attacker is able to inject there shouldn't be executed. But, I'm still pretty new to this, so I thought it would be prudent to ask.

For clarity, this is the context that I'm talking about:

<img src="<?php echo 'Should I escape this url' ?>" />

Yes. You should always escape untrusted data. Here's an attack for your snippet (pseudocode):

<img src="<?php echo 'you should always escape everything, 
                dependeing on the context. This context is url in an attribute, 
                you should escape it appropriately. otherwise " />
                <script>alert("you will be vulnerable")</script><noscript><img "' ?>" />
  • Thanks for the explanation and the helpful code. It seems pretty obvious now. :)
    – Dominic P
    Jan 13 '14 at 20:20

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.