1

OK let's say I have a jQuery function... it's an AJAX Post... well after success I do this 

$("#title"+id).html(Z);

and Z is var Z=$("#"+X+" textarea.editAnswer").val();.

However if I type in the textarea something like <script>alert('Test');</script> and then press save... it will save it and the test alert will popup. So... how do I fix this?

test
  • 17,706
  • 64
  • 171
  • 244

2 Answers2

4

This is code injection and should be avoided with HTML encoding.

Either:

  1. return HTML encoded result from the server (after you've saved it) and populate that into your #title element or
  2. use escape() Javascript function to encode it on the client and populate that result into your #title element

Depending on the scenario, you should always use the one that makes it harder for the user to hack. I'd suggest you use server side approach, because users won't be able to override your custom javascript function and address their own twisted agenda...

Robert Koritnik
  • 103,639
  • 52
  • 277
  • 404
  • 1
    Yep. Right to the point. If someone typed in `` your app would break as well, you need to encode it. – Wesley Murch Apr 14 '11 at 00:32
  • Then I get Yay%2C%20herp%21%3F%20%3Cscript%3Ealert%28%27Test%27%29%3B%3C/script%3E in textarea. What the heck. – test Apr 14 '11 at 02:12
0

Your options are escaping the code or using whitelists.

Do you need the html code? Take a look at this question: How to prevent Javascript injection attacks within user-generated HTML

And then these ones:

Script injection - form validation (jquery)

Do you only run htmlspecialchars() on output or is there other functionality you also do?

Community
  • 1
  • 1
Aleadam
  • 40,203
  • 9
  • 86
  • 108