XSS in EUC-jp over htmlspecialchars
does a japanese charset euc-jp make a xss?
<html>
<body>
<script type="text/javascript">
var a ="<?php echo htmlspecialchars($_GET['a']) ?>";
var b ="<?php echo htmlspecialchars($_GET['b']) ?>";
</script>
</body>
</html>
I would take get parameter a as %f0 then:
<html>
<body>
<script type="text/javascript">
var a =";
var b ="";
</script开发者_运维知识库>
</body>
</html>
I have The bad feeling from that
I'm glad that you give me a some examples
You are pasting user input into Javascript directly. That is a XSS-injection field day. Japanese charset has nothing at all to do with it. Anyone could input any Javascript they like, and your code does nothing to stop it.
It is because you are encoding it against HTML character/escapes... not Javascript ones.
加载中,请稍侯......
精彩评论