Member Avatar for ChrisHunter

I'm currently doing some encoding work to protect a site from XSS attacks. We've stuck a bunch of <script>debugger;</script> tags in the db. Dispite my best efforts, the strings I've encoded to stop the debugger getting hit (to prevent an XSS attack), are still getting hit in developer tools.

Is there a chance that double encoding something could cause this to happen or is that not possible?

Thanks in advance!

Edited by JamesCherrill because: Moved to web development section
  • 1 Contributor
  • 2 Replies
  • 834 Views
  • 1 Month Discussion Span
  • Latest Post Latest Post by ChrisHunter
Member Avatar for ChrisHunter

Sorry I realise I've posted this in the wrong section, it's been a while since I've visited DaniWeb.

commented: OK, I moved it. +14
Member Avatar for ChrisHunter

We solved this by adding a new method to the string object to replace any <script> tags in a string to defuse it.

This solution removes any potential script tags and will prevent any html tags from being encoded (useful when you're trying to render out html from a string.

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.