Re: Feedback: WW-2414, XSS attack is possible if using and

[Antonio Petrelli]

2008/1/16, Jeromy Evans <[EMAIL PROTECTED]>:
>
> <a href="javascript:alert('1&2>3='+(1&2>3));">Link A</a>
>
> HTML escaped is not equivalent:
> <a href="javascript:alert('1&amp;2&gt;3='+(1&amp;2&gt3));">Link B</a>



You forgot a semicolon. The correct link is:
<a href="javascript:alert('1&amp;2&gt;3='+(1&amp;2&gt;3));">Link B</a>
And it *is* equivalent.

Antonio