4 ms·

The second question disallows the script tag.

• tieTYT 12y ago
  How is it doing that?
  • wasd 12y ago
    Using <script> ... as a payload won't work because the browser won't execute scripts added after the page has loaded.
    • goblin89 12y ago
      The browser smartly won't execute scripts added through innerHTML, but it probably should be noted that jquery's html() method will[0]. There's always a way to shoot yourself in the foot. :) [0] http://api.jquery.com/html/ http://api.jquery.com/html/
  • hckr1292 12y ago
    it's not blocking the scripts from being inserted. Inspect the DOM and you'll see them there.
  • tetrep 12y ago
    (spoilers!) https://developer.mozilla.org/en-US/docs/Web/API/Element.innerHTML#Security_considerations https://developer.mozilla.org/en-US/docs/Web/API/Element.inn...