Skip to content

Instantly share code, notes, and snippets.

@obenjiro
Last active October 9, 2015 10:46
Show Gist options
  • Select an option

  • Save obenjiro/0b273a97a9ee55c39393 to your computer and use it in GitHub Desktop.

Select an option

Save obenjiro/0b273a97a9ee55c39393 to your computer and use it in GitHub Desktop.
Always escape quotes
<html>
<head>
<title>XSS with quotes only</title>
</head>
<body>
<span></span>
<script>
// this happens becouse we use raw value inside of attribute "title"
var titleText = 'asd" onmouseover="alert(1)"';
document.getElementsByTagName('span')[0].innerHTML = '<div title="' + titleText + '">'+titleText+'</div>';
</script>
</body>
</html>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment