CODEWITHSUNDEEP
javascripthtmldomxss
JJ Binks
JJ Binks

Reputation: 21

Is HTML encoding angle brackets, &, newline, and quotes enough to prevent XSS?

I am creating a website, and I have a section where the user can provide input via a form. The input is sanitized using this:

str.replace(/[\x26\x0A<>'"]/g,function(r){return"&#"+r.charCodeAt(0)+";"})

After that, the data is placed between <p> tags. So something like this:

<p id="foo">Random message</p>

Is my replacement function good enough to prevent an XSS attack?

Upvotes: 1

Views: 1229

Answers (1)

GKFX
GKFX

Reputation: 1400

This is basically a duplicate of Can I escape html special chars in javascript?. Yes your code is probably safe, it does the same as what the accepted answer there does.

Upvotes: 1

Related Questions