javascript - Java Script Alternate Concatenation Techniques -

javascript - Java Script Alternate Concatenation Techniques -

maybe question noobish not find reply on internet.

<script> var1 = ""; somefuntion(); var2 = ""; </script>

let have script , can alter var1 value entering string. when come in payload "/alert(9)/" var1 script becomes this:

<script> asd = ""/alert(9)/""; qwe(); zxc = ""; </script>

and when browser renders html executes alert() , popup cames. different payloads "|alert(9)|", "!=alert(9)!=" , ";alert(9);// browser still creates popup.

can explain how possible, meaning of script becomes after injecting payloads have shown?

please describe me anatomy of changed script i.e asd variable becomes, meaning of concatenations right , left of alert() mean.

this

asd = ""/alert(9)/"";

means take empty string, split whatever alert(9) returns, split empty string , assign result asd. since js weakly-typed, it's no problem perform partition on strings - returns nan. side effect, see alert.

injecting user input in scripts terrible idea, if must, should escape strings avoid hacks this. safest method run them through json.stringify:

userinput = '"/alert(9)/"' safeexpr = json.stringify(userinput) somejscode = "var asd = " + safeexpr

which gives you

var asd="\"/alert(9)/\""

javascript html5 xss