friend found an interesting method, that should protect from xss injection.
<?php
$source = @$_GET['htmlsc'];
$source = mb_convert_encoding($source, 'UTF-7');
$source = htmlspecialchars($source); //defaults to ISO-8859-1
header('Content-Type: text/html;charset=UTF-8');
echo '<html><body><img src=' . $source . '></body></html>';
?>
This prevent from using characters such as = # < > ; " I've tried many things, but none worked. The biggest problem is that I'm not allowed to use equal sign. Is there something I missed and XSS is possible? Thanks in advance.
