The Web Application Hacker’s Handbook Discovering and Exploiting Security Flaws

Whenever you are probing an application for command injection and other

flaws, having attempted to insert the relevant metacharacters into the data you

control, always try placing a backslash immediately before each such character,

to test for the logic flaw described previously.

N OT E

This same flaw can be found in some defenses against cross-site

scripting attacks (see Chapter 12). When user-supplied input is copied directly

into the value of a string variable in a piece of JavaScript, this value is

encapsulated within quotation marks. To defend themselves against XSS, many

applications use backslashes to escape any quotation marks that appear within

the user’s input. However, if the backslash character itself is not escaped, then

an attacker can submit 

\‘