Re: Can you exploit this XSS?

["Sverre H. Huseby" <shh () thathost com>]

|   What you have run into is called attribute encoding.  When dealing
|   html tag attributes enclosed inside of quotation marks, the only
|   char that is "required" to encode is ".

One should encode & as well, as was done in the initial example.  & is
a metacharacter everywhere, including inside attribute values.  (And
old Netscape would parse &{alert(document.cookie)}; as JavaScript
inside attribute values.)

|   Depending on the browser it may be possible to trick some browsers
|   into thinking your html is broken by injecting line feeds and
|   starting up new tags.

Yes, some browsers are very forgiving.  They may parse stuff that
isn't well formed HTML (if such a thing can be said to exist :) )


Sverre.

-- 
shh () thathost com
http://shh.thathost.com/