JavaScript-Browser decoding order (HTML decoding, URL decoding and JS decoding)

  
   ');">test

Code as above, when the value of the parameter input is: %26lt%5cu4e00%26gt , click on the test text, the content of the popup window is: <一>
Want to know how the browser decodes the sequence from the input parameters to the pop-up window %26lt%5cu4e00%26gt ?

Reply content:

  
   ');">test

Code as above, when the value of the parameter input is: %26lt%5cu4e00%26gt , click on the test text, the content of the popup window is: <一>
Want to know how the browser decodes the sequence from the input parameters to the pop-up window %26lt%5cu4e00%26gt ?

The server receives the request and enters the code logic processing

inputThe value, is URLDecode , becomes<\u4e00>
The page data that the browser obtains from the server has become<\u4e00>
At this point 页面源码 you can see it by looking at (note not right-click on the page 检查元素 )

test

When the browser is rendering

The href string as a URL javascript:alert('<\u4e00>'); is decoded by htmlentity and becomes

');">test

This step can be seen by right-clicking on the page test链接 and selecting 检查元素 , you can see the actual rendered DOM elements

When you click the test link

Execution is actually a JavaScript code, which has a string, which '<\u4e00>' has an escape character \u4e00 on it, which is known by the leader to 逆转义 \u be a Unicode encoded escape, which will be 6 bytes of string '\u4e00' Translates into a Unicode character that actually occupies 3 bytes of space '一' , when the entire string occupies a memory space of

<	a	>
3c	E4 B8 80	3e

If you write directly in the code alert(' <一> '); , the internal storage of this string is the same way

When the alert box is finally rendered

By the system will be on the byte code, translated to the corresponding encoded characters can be displayed, rendered on the screen

