-1

I wonder if the character & is safe to be output to a browser. In case '<' '>' '\'' '\"' '=' are all encoded,

is there a possibility to get damaged by an attack if '&'isn't encoded?

Tharif
  • 13,794
  • 9
  • 55
  • 77
Th3B0Y
  • 884
  • 1
  • 12
  • 30
  • 1
    See http://stackoverflow.com/questions/9124134/cross-site-scripting-xss-do-i-need-to-escape-the-ampersand and the comments – Armand Grillet May 21 '15 at 12:20
  • @ArmandGrillet, thanks. That's what i asked. I searched previously, but as i didn't look for "ampersand" I couldn't find it. – Th3B0Y May 21 '15 at 12:24

1 Answers1

2

It is not safe, you should escape it. You can see an example of exploiting XSS using & here: http://erlend.oftedal.no/blog/?blogid=124

Fernando Garcia
  • 1,946
  • 2
  • 12
  • 14