From the course: ASP.NET: Security

Unlock the full course today

Join today to access over 22,600 courses taught by industry experts or purchase this course individually.

Cross-site scripting (XSS) in JavaScript

Cross-site scripting (XSS) in JavaScript

From the course: ASP.NET: Security

Start my 1-month free trial

Cross-site scripting (XSS) in JavaScript

“

- [Instructor] You may have noticed that I insisted that we are in an HTML context while we were discussing both how crosshead scripting works and how to mitigate that. And indeed that's important because if we are in a JavaScript context, some things change. Let's have a look at the application. Here we are putting the user's input directly into a JavaScript string and then put that string into our H1 heading further up on the page. And this is the problem. We have the at character here which means that opening and closing angled brackets are escape for HML. Single and double quotes are escape, and the ampersand character is escaped as well. But within a JavaScript string, there are other special character which are not taken into account here. One very obvious special character is here. Well, first of all, the single quote because it delimits the string. But that's been taken care of. However, what else is a special character within a JavaScript string? Quite obviously, it's the…

Contents