Difference between JS encode and URL encode

Question

What is the difference between JavaScript encoding and URL encoding. I am not able to figure out exact difference between them. Also that are following types of encoding are called

%HH
\u00HH
&#HH;
\\
\HH

Any more encoding schemes used in Web technologies?

Where did you get the term, "JavaScript encoding"? Do you mean JSON? — Pointy
– Pointy, Commented Feb 19, 2014 at 15:58
@pointy I gave an interview and interviewer was continuously stressing on JavaScript encoding. I thought I do not know about it. — Gaurav
– Gaurav, Commented Feb 19, 2014 at 16:03
@Pointy It is another term for JavaScript escaping. Not JSON itself, but a subset (by that I mean used per string literal). e.g. changing " to \x22 — SilverlightFox
– SilverlightFox, Commented Feb 19, 2014 at 18:47

Bergi · Accepted Answer · 2014-02-19 16:10:28Z

1

%HH

Percent encoding as used in URIs.

\u00HH

Unicode escape sequence. For JavaScript specific things, read the spec on String literals.

&#HH;

HTML entity, or numeric character reference.

\\

Could be anything. Usually escaping the backslash when the backslash is used for escaping things.

\HH

Maybe you're referring to a named escape sequence here. See escape sequences in C-based languages

edited Feb 19, 2014 at 16:10

answered Feb 19, 2014 at 16:05

Bergi

671k162 gold badges1k silver badges1.5k bronze badges

Sign up to request clarification or add additional context in comments.

7 Comments

Gaurav Over a year ago

If I escape all the data using &#HH; or %HH encoding, will I be completely safeguarded for XSS attack?

Bergi Over a year ago

@Gaurav: No. URI encoding should not play a role in XSS. Escaping strings in the HTML is definitely good practice, but there are still XSS attacks that can work around that.

Gaurav Over a year ago

<img src="#" onmouseover="<?php echo htmlspecialchars($_GET['xss']); ?>"> is vulnerable to alert(1) string. What encoding is suggested? There are more such cases.

Bergi Over a year ago

onmouseover does expect a js expression, so I'm not sure what you want. You might consider something like <img src="#" onmouseover="<?php echo htmlspecialchars("alert(".json_encode($_GET['xss']).");"); ?>">

Gaurav Over a year ago

Does json_encode only gives wrapper on double quotation? Also is it available in all web development languages?

|

Collectives™ on Stack Overflow

Difference between JS encode and URL encode

1 Answer 1

7 Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

7 Comments

Your Answer

Sign up or log in

Post as a guest

Related