Craig Younkins <cyounk...@gmail.com> added the comment:
Proof of concept:
print """<body class='%s'></body>""" % cgi.escape("' onload='alert(1);' bad='")---------- _______________________________________ Python tracker <rep...@bugs.python.org> <http://bugs.python.org/issue9061> _______________________________________ _______________________________________________ Python-bugs-list mailing list Unsubscribe: http://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com
