in reply to Script Stripper
It may be better to define what IS allowed, instead of what's NOT. HTML changes continuously, and browsers don't always follow specs...<style> span.blah { background-color: expression(alert('Hello, World!' +)) } </style> <a href="javascript:alert('Hello, World!');">hi mom</a> <img src="fourohfour" onerror="alert('Hello, World!');">
|
|---|
| Replies are listed 'Best First'. | |
|---|---|
|
Re: Re: Script Stripper
by japhy (Canon) on Dec 26, 2001 at 09:58 UTC | |
by Juerd (Abbot) on Dec 26, 2001 at 11:21 UTC |