note 29169 deleted from function.strip-tags by nlopess
| From: | nlopess@php.net | Date: | Thu, 11 Mar 2004 14:54:18 +0000 |
| Subject: | note 29169 deleted from function.strip-tags by nlopess | ||
| References: | 1 | Groups: | php.notes |
| Request: | Send a blank email to php-notes+get-66647@lists.php.net to get a copy of this message | ||
Note Submitter: icon.at.linux.dot.duke.dot.edu
----
So, what happens if I submit
<scr<script></script>ipt>alert(1)</scr<script></script>ipt>?
Your parsers will remove <script></script> and leave the "safe" html with:
<script>alert(1)</script>.
Mission accomplished.