diff --git a/developer_manual/general/security.rst b/developer_manual/general/security.rst index ba612854c..be5b0b70b 100644 --- a/developer_manual/general/security.rst +++ b/developer_manual/general/security.rst @@ -71,13 +71,13 @@ Avoid manipulating the HTML directly via JavaScript, this often leads to XSS sin .. code-block:: js - var html = '
  • ' + username + '
  • "'; + var html = '
  • ' + username + '
  • "'; If you **really** want to use JavaScript for something like this use `escapeHTML` to sanitize the variables: .. code-block:: js - var html = '
  • ' + escapeHTML(username) + '
  • '; + var html = '
  • ' + escapeHTML(username) + '
  • '; An even better way to make your app safer is to use the jQuery builtin function **$.text()** instead of **$.html()**. @@ -152,15 +152,15 @@ PHP offers the following functions to escape user input: .. code-block:: php -