Is obtaining the value of a
input with the jQuery function
<html> <textarea id="t1"></textarea> <script> var toBeDisplayed = $('#t1').val(); $('#elem').html(toBeDisplayed); </script> </html>
Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.Sign up to join this community
As Gumbo mentioned in his comment, it does not matter what you read in, but it does matter what you display after the fact. To simply answer your question, no. jQuery's
.val() does not have any filtering that will protect you from XSS. You could perhaps take in the value into
var toBeDisplayed and then perform your own filtering before it gets relayed to be displayed again.