A value is HTML-escaped and then placed into an inline script: var q = '{{value}}'; . Why is this still unsafe?

HTML escaping doesn't protect a JavaScript string context; the value needs JS-specific encoding or should be passed another way

Because inline scripts can't contain variables

Because HTML escaping turns quotes into spaces

Web Security · Middle · Question 1 of 75

A value is HTML-escaped and then placed into an inline script: `<script>var q = '{{value}}';</script>`. Why is this still unsafe?

1Because inline scripts can't contain variables
✓Correct answer: HTML escaping doesn't protect a JavaScript string context; the value needs JS-specific encoding or should be passed another way
3Because HTML escaping turns quotes into spaces

Explanation

Each context has its own escaping rules. The safest option is to avoid it: put data in a data- attribute or a JSON block and read it from your script.

A value is HTML-escaped and then placed into an inline script: `<script>var q = '{{value}}';</script>`. Why is this still unsafe?

Explanation

Further reading

Problem with a question

Test yourself

Feedback

A value is HTML-escaped and then placed into an inline script: <script>var q = '{{value}}';</script>. Why is this still unsafe?

Explanation

Further reading

Test yourself

A value is HTML-escaped and then placed into an inline script: `<script>var q = '{{value}}';</script>`. Why is this still unsafe?