code_junkie

Will HTML Encoding prevent all kinds of XSS attacks?

Nov 10th, 2011
127
0
Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 0.28 KB | None | 0 0
  1. <input value=<%= HtmlEncode(somevar) %> id=textbox>
  2.  
  3. a onclick=alert(document.cookie)
  4.  
  5. <input value=a onclick=alert(document.cookie) id=textbox>
  6.  
  7. +ADw-script+AD4-alert(document.cookie)+ADw-/script+AD4-
  8.  
  9. # Markup example
  10. [foo](javascript:alert('bar');)
  11.  
  12. <script/>
Add Comment
Please, Sign In to add comment