Re: DOMDocument and <script> tag - XSS test

The problem is that you're escaping incorrectly for the context. It takes more than just htmlspecialchars to escape for a javascript data context. Check this out: https://www.owasp.org/index.php/XSS_(Cross_Site_Scripting)_Prevention_Cheat_Sheet#RULE_.233_-_JavaScript_Escape_Before_Inserting_Untrusted_Data_into_JavaScript_Data_Values Anthony On Mon, Jul 16, 2012 at 12:54 AM, Raymond Irving <xwisdom@gmail.com> wrote: > Hello, > > I'm having a problem with the DOM parser: > > If I load the following using DOMDocument->loadHTML(): > > <script type="text/javascript"><!-- > var d="&quot;;alert('This is an XSS test'); //"; > </script> > > it will be converted to: > > <script type="text/javascript"><!-- > var d="";alert('This is an XSS test'); //"; > </script> > > This is because parser is substituting '&quot;' for '"'. > > Is there a way to prevent this from happening? > > __ > Raymond >