documentcloud/backbone — Issue #1034: backbone FAQ encourages an approach vulnerable to script injection
Author: gfxmonk
Created: 2012-02-21 10:41:44+00:00
State: open

Just a heads up that the advice at http://documentcloud.github.com/backbone/#FAQ-bootstrap is bad - a simple JSON encode leaves you open to javascript injection attacks for data that contains e.g "".

You should actually do a json encode, then replace "<\" with "<\/". At least for html, the rules for xhtml may be different. You can read more here:
http://stackoverflow.com/questions/779959/is-it-necessary-to-escape-character-and-for-javascript-string

Unfortunately, there seems to be no good name for this kind of encoding (maybe it's related to sgml?) so it's kinda hard to find information on the topic.