避免在vue烤的通知标题中使用跨站点脚本（XSS）

Question

I use vue-toasted when inject js code ex. "><img src=1 onerror=prompt(document.cookie);> in input and click submit.

Notification show like that: and popup show with cookie :/ .

and console.log(response.data.message); show:
Created Site ""><img src=1 onerror=prompt(document.cookie);>" successfully!

vue is escaping html but toasted is not, here is the code:

handleFormSubmit: function(response) {
        this.showAddSiteModal = false;
        if (response.data.status === 'success')
        {
            console.log(response.data.message);
            this.$toasted.success(response.data.message); //<<< problem here
            this.addSite(response.data.site);
        }
        else
        {
            this.$toasted.error(response.data.message);
        }
    },

Answer 1

在php端使用htmlspecialchars（） 。