Hacker News new | past | comments | ask | show | jobs | submit login

what on earth has happened with engadgets url structure?

tried (albeit briefly) to re-write it to get to the desktop version, failed a couple of times before i spotted the desktop link at the bottom, which looks to append ?m=false, and now the first piece of content in the body element is the word "false", presumably debugging stuff, hope that's sanitised properly!




It's not:

http://www.engadget.com/2012/03/01/foursquare-replaces-googl...

Interestingly, Chrome doesn't execute that because it finds the source of the script in the request. Good XSS avoidance idea.


I tried that in chrome too, saw it didnt work and presumed the site handled it, not my browser, IE9 avoids it as well, even shows a little popup saying the site has been modified to prevent xss, latest FF still displays the alert though.


Safari also appears to prevent the alert. Must be built into WebKit.


Nope. Ipad show the text


They escape single- and double-quotes, what else is there to worry about?




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: