2010/8/26 Kornel Lesiński <[email protected]>: > On Wed, 25 Aug 2010 22:52:42 +0100, Kornel Lesiński <[email protected]> > wrote: >>> <script> >>> elmt.innerHTML = 'Hi there <?php echo htmlspecialchars($name) ?>.'; >>> </script> >> >> These cases can be secured without any new features in browsers (by >> escaping whitespace using numeric entities): > > I realized I was wrong about this one. It won't prevent script injection in > JS strings (in places where entities are decoded, including <script> in > XML), because entity will be changed to plain text before JavaScript is > tokenized.
Indeed. This is not a feature for XML. XML won't decode the entity at all. In HTML, <script> doesn't decode entities, so the pattern is safe. Adam
