Do not underestimate the comments out of JS caused by security problems _javascript skills

One is the header insertion problem.
The other is the \ r \ n issue.
Let's look at a piece of code like this:
1. Test
2. <script>
3.//alert (' <%=request.getparameter ("username")%> ');
4. </script>
As you can see, there seems to be a loophole, but it has been made up and commented out.
So since the notes are off, shouldn't there be any problems?
No.
Look at this URL again.
Http://localhost/index.jsp?username=kxlzx%0d%0a%0d%0aalert (' Kxlzx
Very helpless, huh?
The following code was generated:
Test
<script>
Alert (' Kxlzx
Alert (' Kxlzx ');
</script>
Commented out of JS, also executed.
So, do not put useless code, commented out of JS, etc., thrown into the HTML.
Code audits are a WINS, and any omissions are worth noting.