New answers tagged


Creating the DOM as string and using append or html indeed leads to DOM-based XSS. What you should do instead is to built the DOM elements using the proper functions and only inserting user-supplied input as text. Example: <script src=""></script> <ul id=my_list class=my_list>&...

Top 50 recent answers are included