Study. uk . com
  1. Home
  2. All questions
  3. Question 150

CompTIA Security+ study material · question 150 of 611

A developer wants to insert a user-supplied value directly inside a script block, encoded carefully. What is OWASP's guidance?

  1. Use HTML entity encoding instead
  2. Wrap it in a Content Security Policy nonce
  3. Avoid that location entirely, because no encoding makes it safe
  4. Use JavaScript encoding, which makes it safe
Show the answer

Answer: C. Avoid that location entirely, because no encoding makes it safe

Untrusted data inside a script block or event handler is unsafe regardless of encoding, so the pattern must be avoided.

Source: OWASP Cross Site Scripting Prevention Cheat Sheet (OWASP) — OWASP Cross Site Scripting Prevention Cheat Sheet › Framework Security

Challenge yourself on this topic → Study as cards