EncodeUri Function in JavaScript

Question

I am generating a search output based on a user query and generating search result pages like this

location.href = root_url + "SearchCenter/Pages/internal.aspx" + "?q=" + st

I am looking into protecting against XSS attacks.

I am using encodeURI to protect against the attack with

encodeURI("http://Server.com/SearchCenter/Pages/internal.aspx?q=<script>alert('dd')</script>)"

which outputs

http://server.com/SearchCenter/Pages/internal.aspx?q=%3Cscript%3Ealert('dd')%3C/script%3E)

Now what if instead of tag they enter JavaScript:Alert('dd') which encodeURI would not protect against.

So my question is that is there any JS library or function that I can use to protect against URL XSS attacks.

Nothing on the client-side is protected if the user doesn't want it to be. It's the server-side that needs to have protections put in place. — Pluto
– Pluto, Commented May 11, 2015 at 15:46

Koen Peters · Accepted Answer · 2015-05-11 15:46:34Z

3

You should solve this server side. Never trust the client so whatever it sends should be vetted on the server before being rendered in the HTML. So accept whatever they send and use a server component to make sure that whatever gets outputted is safe.

answered May 11, 2015 at 15:46

Koen Peters

12.9k6 gold badges40 silver badges62 bronze badges

Sign up to request clarification or add additional context in comments.

Collectives™ on Stack Overflow

EncodeUri Function in JavaScript

1 Answer 1

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

Comments

Your Answer

Sign up or log in

Post as a guest

Related