Security problems caused by different language formats

Today, I saw a blog by Daniel of mindedsecurity 《A Twitter DomXss, a wrong fix and something moreAs mentioned in "twitter's dom-xss error fix method, the key to this error fix is the use of javascript replace function errors:

Var c = location. href. split ("#! ") [1];
If (c ){
Window. location = c. replace (":","");
} Else {
Return true;
}

The format standard of replace () in javascrpt does not support global replacement by default, that is, c. replace (":", "") will only replace the first one, so we can use: to bypass it, instead of making the replace () of js () supports global replacement. replace (":", "", "g") or c. replace (/:/g ,"").

Why are such low-level errors reported by programmers? During our development process, many scripts and languages are used in combination. For example, I once started a 'project' and used scripts such as asp php js vbs perl, however, the format standards of different languages are different, which makes it easy to see the above low-level errors!

For example, the above replace function is replaced globally by default in php vbs/asp.

Php> php-r "print str_replace (80, 90, 80vul80vul );"
90vul90vul

Wscript. echo replace ("80vul80vul", "80", "90 ")
C:> cscript v. vbs
Microsoft (R) Windows Script Host Version 5.6
Copyright (C) Microsoft Corporation 1996-2001. All rights reserved.

90vul90vul

This problem is caused by the annotation symbol and the conversion symbol... In addition, this kind of problem is also manifested in the SQL script format standards of major databases.