Comment on Show HN: Roomchat – No signup instant custom chat roomsComments−mike-cardwell11yXSS by writing the message: <i<script></script>mg src="#" onerror="alert(1)"> Just stripping out tags doesn't work. Stripping out the script tags there simply ends up creating another new tag. You need to understand and implement proper escaping.
Comments
XSS by writing the message:
Just stripping out tags doesn't work. Stripping out the script tags there simply ends up creating another new tag. You need to understand and implement proper escaping.