Webmasters Stack Exchange is a question and answer site for pro webmasters. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

My friend is kind of web-developer, beginner. I noticed that he didn't purify his user input on form submission, so I could easily save to his DB working <script>alert();</script>.

After some nice trolling with JavaScript, he changed his code to swap any < character to s. So for example writing <script>alert();</script> would save to DB as sscript>alert();s/script>.

As being friend, I want to show that this is not the solution, and here goes the question - Is it possible to void JavaScript, when this kind of "security" is used?

share|improve this question
Is he doing the string update using JavaScript? Most browsers have the option to disable JavaScript. What would happen then? – Dave Feb 12 '14 at 10:41
up vote 1 down vote accepted

JavaScript should not be used for security, never! JavaScript can easily be turned of. It is good for client validation, but everything related to security should be done on server side, and that includes filtering the inputs.

share|improve this answer
Why would be be saving javascript code to the database? – Steve Feb 11 '14 at 21:30
@Steve - cross site scripting attacks? – Dave Feb 12 '14 at 10:40

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.