An expert recommended that the user content, replyContent, be surrounded by a <pre> tag to prevent XSS attacks. However, why is it commonly believed that this code effectively prevents XSS?
I attempted to inject
</pre><script>alert("XSS");</script><pre>Therefore, is the current protection in place (which removes special characters like <,>,/,',& etc) adequate, or is there a way to bypass this safeguard?
Does anyone have any insights?
Snippet of Code:
$row = $("<tr class='wp_replies_tr'></tr>");
...
$msgColumn5 = $("<td width='112' class='wp_msgCol5'></td>");
$preTag = $("<pre class='wp_reply_content'></pre>");
$pre.text( replyContent );
$msgColumn5.html($pre);
$row.append($msgColumn5);