Logo Questions Linux Laravel Mysql Ubuntu Git Menu
 

"%3Cscript" vs "<script"

Every once in a while, I'll see an HTML code snippet with:

%3Cscript

where the %3C replaces the <. Is this because the code was auto-generated or needs to display properly in an editor or was it coded that way explicitly for some reason and needs to keep that form on the HTML webpage? In case it is helpful here is the full beginning of the line of code I was questioning:

document.write(unescape('('%3Cscript

Wouldn't the line of code work just fine it you replaced the %3C with a <?

like image 681
Ken Boone Avatar asked Oct 05 '22 17:10

Ken Boone


1 Answers

The unescape() Javascript function converts the %3C back to < before it gets written into the document. This is apparently an attempt to avoid triggering scanners that might see the literal <script tag in the source and misinterpret what it means.

like image 62
Greg Hewgill Avatar answered Oct 08 '22 10:10

Greg Hewgill