Hi all,
On Tue, Feb 4, 2014 at 7:37 AM, Yasuo Ohgaki <[email protected]> wrote:
> On Tue, Feb 4, 2014 at 7:31 AM, Pádraic Brady <[email protected]>wrote:
>
>> While I'm dubious about forward slash escaping myself and think it
>> might have been OWASP veering into overkill,
>>
>
> Yes they are. They are very conservative to security.
> For example, they suggest to escape almost all char by applying
> HEX escape for JavaScript string literals.
>
> It may be too much, but I'm sure it's more secure.
>
If anyone interested in PHP implementation of OWASP suggested JavaScript
string literal escape. This is my blog for it.
http://blog.ohgaki.net/javascript-string-escape
It's written in Japanese. You may recognize PHP code and use google
translate or like if you would like to read content.
Regards,
--
Yasuo Ohgaki
[email protected]