: How to void JavaScript on submission? My friend is kind of web-developer, beginner. I noticed that he didn't purify his user input on form submission, so I could easily save to his DB working

@Gail5422790

Posted in: #Javascript

My friend is kind of web-developer, beginner. I noticed that he didn't purify his user input on form submission, so I could easily save to his DB working <script>alert();</script>.

After some nice trolling with JavaScript, he changed his code to swap any < character to s. So for example writing <script>alert();</script> would save to DB as sscript>alert();s/script>.

As being friend, I want to show that this is not the solution, and here goes the question - Is it possible to void JavaScript, when this kind of "security" is used?

Vote Up Vote Down

Login to post a comment!