JQuery magicpreview plug-in

Re:JQuery magicpreview plug-in by riklomas on Thursday November 20, 2008 @10:51AM (#370671)

You can use the options to set the output as text() rather than html(), e.g. $('div').magicpreview('mp_', { 'change': 'text' });

But yes, I should really add a flag to strip out any script elements :)

[ Parent | on HN ]

Re:JQuery magicpreview plug-in by technoguyrob on Thursday November 20, 2008 @07:53PM (#371303)

XSS detection is not just as simple as that. For example, in IE, entering the following produces a pop-up:

   <table style="background-image:url(javascript:alert(1))"><tr><td>Hi</td></tr></table>

However, read debt's comment below. XSS is irrelevant here since "XSS" means cross-site scripting, i.e., ,managing to embed Javascript into pages someone ELSE sees. Only the client sees this, it doesn't get reproduced for anyone else.

[ Parent | on HN ]