CODEWITHSUNDEEP
javascriptjqueryxss
Alex Pavlov
Alex Pavlov

Reputation: 598

The way to check the javascript injections

Is it enough to avoid javascript injection validating input data in such way:

xssValidate = function(value) {
    var container = $("<u></u>").text(value);
    if($(container).html() != value) return mc.ERROR_INVALID_FORMAT;
}

I've managed to validate all the text fields and textareas values with the code above before submit them to server.

Upvotes: 1

Views: 889

Answers (1)

Greg
Greg

Reputation: 321698

I think that's going to be very annoying for your users... what if I want to type "this & that" or "11 > 7"?

What you should be doing really is escaping it when you output it.

Additionally, I hope you're validating on the server as well as the client side.

Upvotes: 6

Related Questions