WeChat editor seems to be able to use code, but it is estimated that XXS is impossible. I want to know how WeChat filters and processes the data submitted by our edits?

The editor seems to be able to use code, but it is estimated that XXS is impossible. I want to know how to filter and process the data submitted by our edits? For example, I write an & amp; lt; imgsrc & quot; onclick & quot; alert (1) & quot; & amp; gt; how does the background handle such a situation? It seems that the editor can use code, but it is estimated that XXS is impossible. I want to know how to filter and process the data submitted by our edits?

For example

How does the background handle such a situation?

The HTML code is rich in text and text content, but it also avoids risks. I want to know how this situation is handled.

Hope you can give me some advice. Thank you!

Reply content:

The editor seems to be able to use code, but it is estimated that XXS is impossible. I want to know how to filter and process the data submitted by our edits?

For example

How does the background handle such a situation?

The HTML code is rich in text and text content, but it also avoids risks. I want to know how this situation is handled.

Hope you can give me some advice. Thank you!

When submitting an article, you can see the submitted parameters. To put it simply, escape:ScriptThe tag will be escaped. In this case, the tag will also be escaped. In additionTags are also escaped. Parameters are filtered twice in the browser and when submitted to the server. Therefore, the desire to construct a request to submit illegal Code cannot be fulfilled.