Study. uk . com
  1. Home
  2. All questions
  3. Question 149

CompTIA Security+ study material · question 149 of 611

Why does a single encoding function not prevent all cross-site scripting?

  1. Because encoding is applied on the client rather than the server
  2. Because HTML body, attribute, JavaScript and URL contexts each need different encoding
  3. Because encoding is slower than validation
  4. Because modern browsers ignore encoded characters
Show the answer

Answer: B. Because HTML body, attribute, JavaScript and URL contexts each need different encoding

The safe transformation depends on where the data lands, so context-appropriate encoding is what is required.

Source: OWASP Cross Site Scripting Prevention Cheat Sheet (OWASP) — OWASP Cross Site Scripting Prevention Cheat Sheet › Output Encoding

Challenge yourself on this topic → Study as cards