The Web Application Hacker’s Handbook Discovering and Exploiting Security Flaws

”>

The resulting HTML is entirely valid and is equivalent to only the portions

highlighted in bold. The chunks of source code in between have effectively

become JavaScript comments (surrounded by the 

/*

and 

*/

markers) and so

are ignored by the browser. Hence, your script is executed just as if it had been

inserted whole at one location within the page.

T I P

The technique of spanning an attack payload across multiple fields can

sometimes be used to beat other types of defensive filters. It is fairly common to

find different data validation and sanitization being implemented on different