Skip to content
This repository has been archived by the owner on Jul 15, 2019. It is now read-only.

Commit

Permalink
Merge pull request #52 from brendannee/patch-1
Browse files Browse the repository at this point in the history
Fixed README example function
  • Loading branch information
adon-at-work committed Sep 10, 2015
2 parents aff9a5a + 24a61b8 commit bd6a3af
Showing 1 changed file with 1 addition and 1 deletion.
2 changes: 1 addition & 1 deletion README.md
Original file line number Diff line number Diff line change
Expand Up @@ -15,7 +15,7 @@ Secure XSS Filters

- **More Secure.** Context-dependent output filters that are developer-friendly. It is safe to apply these filters like so:

`document.write("<a href=" + xssFilters.uriInUnquotedAttr(url) + ">" + xssFilters.uriInHTMLData(url) + "</a>");`
`document.write("<a href=" + xssFilters.uriInUnQuotedAttr(url) + ">" + xssFilters.uriInHTMLData(url) + "</a>");`

In this example, the traditional wisdom of blindly escaping some special html entity characters (`&` `<` `>` `'` `"` `` ` ``) would not stop XSS (e.g., when `url` is equal to `javascript:alert(1)` or ` onclick=alert(1)`).

Expand Down

0 comments on commit bd6a3af

Please sign in to comment.