How to HTML special chars using the xmlhttp.open?

Question

Please bear with me as I am a newbie programmer. Is their a way that HTML special chars can be used in call as this one: xmlhttp.open("POST","login/login.php",true); because when I check my URL adding this

/%22%3E%3Cscript%3Ealert('hacked')%3C/script%3E

turns

/"><script>alert('hacked')</script>

that somebody says my website can be exploit.

Can somebody help me or link a to similar question ?

Thanks in advance.

Answer 1

Use javascript encodeURIComponent when passing parameters in your ajax request, this will properly encode the user data.

Read here: https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/encodeURIComponent