Say I have a site that allows me to save my name to the database, and that name is then displayed to other users.
I have determined that if I save the following as my name:
Abe <script>alert(1);</script> Miessler
Another page in the site will take the following steps all on the client side:
- Make an AJAX request to get a list of user names
- Return those unencoded values (so
<scrip....is returned not
- The page then HTML encodes any values that were returned and renders them on the page
I know that one should not count on anything on the client side for security, but I cannot think of a scenario where an attack would be able to get through here. Can it be done?