是HTML文本框的值从XSS攻击属性安全吗？ [英] Are HTML textbox value attributes safe from XSS attacks?
问题描述
我有一个文本框，在这里我想允许用户在键入潜在危险的字符，如＆LT的能力; 和＆GT; （这是需要我在文本框禁用ASP.NET验证数学EX pression数据输入字段）。数据被存储在数据库中，并稍后用于在网页上显示检索。当我在文本框中显示的数据，我将其设置是这样的：
I have a textbox where I want to allow users the ability to type in potentially dangerous characters such as < and > (this is a mathematical expression data entry field which required me to disable ASP.NET validation on the textbox). The data is stored in a database and retrieved later for display on the page. When I display the data in the textbox, I am setting it like this:
textboxA.Text =前pression; ，其中前pression 来自与数据库有潜在危险的人物。
textboxA.Text = expression; where expression comes from the database with the potentially dangerous characters.
不管怎样，我试着故意插入类似＆LT;脚本＆GT;警报（'你好'）＆LT; / SCRIPT＆GT; ，但我不能让这个脚本时，文本属性设置（转换为值执行在客户端HTML属性的结果是这样的：
Anyway, I tried purposely inserting something like < script>alert('hi') < /script> but I can't get this script to execute when the Text property is set (translates to value attribute in client-side HTML. The result looks like:
＆LT; INPUT TYPE =文本VALUE =＆LT;脚本＆GT;警报（'你好'）＆LT; / SCRIPT＆GT;＆GT;＆GT;＆LT; /输入＆GT;
那么是什么原因，是值属性从注射安全吗？
So what gives, is the value attribute safe from injections?
注意：在示例每个标签前的空间仅适用于计算器，因为它会删除提问标签
Note: The spaces before each tag in the examples is only for StackOverflow because it deletes tags from questions.
推荐答案
的内置文本框控件自动连接codeS文本属性。当你检查输出，你有没有使用查看源文件或开发者控制台。控制台显示转义数据转义，而查看源文件会显示实际输出。
The builtin textbox control automatically encodes the text attribute. When you checked the output, did you use view source or the developer console. The console shows escaped data as unescaped, while view source will show the actual output.
不管怎么说，在文本框的值属性的经典攻击是：自动对焦的onfocus =警告（1）
Anyways, a classical attack on textbox value attributes would be:
" autofocus onfocus="alert(1)
这篇关于是HTML文本框的值从XSS攻击属性安全吗？的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！
