KnowledgeHub
Questions
Tags
Users
Search
Alex Rivera
|
Logout
Edit Question
Title
Body
Let's say we have this form, and the possible part for a user to inject malicious code is this below ... <input type=text name=username value= <?php echo htmlspecialchars($_POST['username']); ?>> ... We can't simply put a tag, or a javascript:alert(); call, because value will be interpreted as a string, and htmlspecialchars filters out the <,>,',", so We can't close off the value with quotations. We can use String.fromCode(.....) to get around the quotes, but I still unable to get a simple alert box to pop up. Any ideas?
Tags (comma-separated)
Save Edits
Cancel