New answers tagged

0

You would maybe be able to do it if the charset was not atypical, and then you may be able to get a valid result by using a multibyte character converting into an equals sign, but you can't change the charset yourself as it will probably appear in the server response header, or default to UTF-8. In Section 12.1.2.1-3 of the HTML standards, tags have to be ...


1

Is \ converted to \\? If not, break out of the string using \"; it'll be converted to \\", which will be treated as a sole (escaped) backslash and then a string-terminating quotation mark. Inserting a newline will break the string, but also break the JS application. If you don't have some way to recover from that - such as the ability to insert a new script ...


Top 50 recent answers are included