CS Fundamentals Trainer · JavaScript · Security

A template HTML-escapes <, >, &, " and ', then renders a user-supplied profile link as <a href="{{url}}">. Which input still runs script…

A template HTML-escapes `<`, `>`, `&`, `"` and `'`, then renders a user-supplied profile link as `<a href="{{url}}">`. Which input still runs script when a visitor clicks the link?

  1. `"><script>alert(1)</script>`
  2. `' onmouseover='alert(1)`
  3. `javascript:alert(document.cookie)`
  4. `https://example.com/?q=<script>`

Difficulty: medium

Answer this question

Related questions