note 125995 added to faq.html

I think the last example on this page may have a XSS vulnreability, e.g. sending the query string ?a="+alert('XSS')+" might cause alert('XSS') to be executed in the browser. The problem with that is that " will be percent encoded by the browser, but there could be some way to bypass the percent encoding and i think it's not good to rely on the percent encoding for security. ---- Server IP: 45.112.84.4 Probable Submitter: 45.112.85.242 (proxied: 185.47.220.165) ---- Manual Page -- https://php.net/manual/en/faq.html.php Edit -- https://main.php.net/note/edit/125995 Del: integrated -- https://main.php.net/note/delete/125995/integrated Del: useless -- https://main.php.net/note/delete/125995/useless Del: bad code -- https://main.php.net/note/delete/125995/bad+code Del: spam -- https://main.php.net/note/delete/125995/spam Del: non-english -- https://main.php.net/note/delete/125995/non-english Del: in docs -- https://main.php.net/note/delete/125995/in+docs Del: other reasons-- https://main.php.net/note/delete/125995 Reject -- https://main.php.net/note/reject/125995 Search -- https://main.php.net/manage/user-notes.php