jquery xss prevention when using html()

Question

I have this line of code with jquery, and I have been told that this line is vulnerable to xss, because I didn't escape the raw data before inject it using html() function.

Please let me know how to escape the data to make it more secure. (I can use javascript instead if that would solve the problem ie. get element by id etc.)

var data= "Some data from user or elsewhere";

$("output_area").html(data);

You're really only vulnerable to persistent XSS if the data comes from the server and was originally inputted by a user before it was stored etc. In other words, validating input is key. — adeneo
– adeneo, Commented Jun 8, 2015 at 19:29

bjfletcher · Accepted Answer · 2015-06-08 19:34:07Z

2

You'd have to use:

$("output_area").text(data)

If you want to inject HTML code, then you'd need to extract from the data and adding them as texts to HTML code that you yourself construct ($('<p/>').text(extractedParagraph), etc).

answered Jun 8, 2015 at 19:34

bjfletcher

11.6k5 gold badges58 silver badges70 bronze badges

Sign up to request clarification or add additional context in comments.

2 Comments

hcythp Over a year ago

Thank you for the responds, I have this string '<h2>Heading Text</h2><div> This is the content</div>' <---One big string. I need to inject this whole thing to a div call "output_area". Do you know a way to do this to prevent xss?

bjfletcher Over a year ago

Security guru and web developer would be happy if you could have the data as JSON - e.g., { h: "Heading Text", p: "This is the content" } - and then .text() them in - e.g., $('#container').append($('<h2/>').text(data.h)).append($('<p/>').text(data.p)).

Collectives™ on Stack Overflow

jquery xss prevention when using html()

1 Answer 1

2 Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

2 Comments

Your Answer

Sign up or log in

Post as a guest

Related