防止输入类型受到XSS攻击

Question

I get the value from input type like this:

var num        = $(document).find('#num').val();

I've tried to avoid the input type from XSS attacks with the following code:

num = jQuery(num).text().replace( 'script', '' ) ;

but it's not working.Any other ideas ?

Answer 1

Even if this code works, you cant prevent xss attacks with javascript. if you want to do it with this: $(document).find('#num').val($(document).find('#num').val().replace('script',''));

Now you have value in you input which script strings deleted but what if someone write <scscriptript> in in your input? after script string deleted in middle, there will be another script tag. You have to check your inputs in server side.