Web Security · Middle · Question 11 of 75
An app writes a user's display name into an attribute without quotes: <div title={{name}}>. What makes this worse than a quoted attribute?
- 1It makes no difference
- 2Unquoted attributes are ignored by browsers
- ✓Correct answer: A space in the value ends the attribute, so the attacker can add new attributes like
onmouseover=...
Explanation
Unquoted attributes can be broken by many characters. Always quote attributes and use attribute encoding.