News for hackers. Stuff that matters.

A comment on /story/6299243. Parent comment

Re: by pigscantfly on Thursday August 29, 2013 @07:45PM (#6299335)
Even if it's not SQL oriented, it could still be to mitigate some kind of injection attack. This is an interesting question; I hope someone with more specific knowledge takes the time to answer it.
[ Parent | on HN ]
Re: by stevelosh on Thursday August 29, 2013 @09:09PM (#6299656)
like foo.com'onclick="alert('hi');"

But yeah the right way to do this is to use a well-tested urlencoding library, not to strip out dangerous-looking characters.

[ Parent | on HN ]