DOMDocument and <script> tag - XSS test
| From: | Raymond Irving | Date: | Mon, 16 Jul 2012 04:54:12 +0000 |
| Subject: | DOMDocument and <script> tag - XSS test | ||
| Groups: | php.internals | ||
| Request: | Send a blank email to internals+get-61271@lists.php.net to get a copy of this message | ||
Hello,
I'm having a problem with the DOM parser:
If I load the following using DOMDocument->loadHTML():
<script type="text/javascript"><!--
var d="";alert('This is an XSS test'); //";
</script>
it will be converted to:
<script type="text/javascript"><!--
var d="";alert('This is an XSS test'); //";
</script>
This is because parser is substituting '"' for '"'.
Is there a way to prevent this from happening?
__
Raymond