Stack Apps is a question and answer site for apps, scripts, and development with the Stack Exchange API. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Question's title attribute is not HTML encoded.


 title: "Problems with HTML <marquee> tag"

 title: "<Canvas>  contents as data?"

I found it when on my app i saw a scrolling word due to the <marquee> tag on the title :).

In a very remote way, this could be a problem, because afaik there are no constraints on question's title submission.
I could forge a question title (300 chars max) like:

What this script <script>evil_script_that_steal_your_stackexchange_webapp_cookies();</script> does?
share|improve this question
I have noticed that from long time, and I was thinking it is by-design :P (may be not), and encoding myself for following 3 chars &, ", < in order. – YOU Jun 16 '10 at 7:53
@S.Mark me too, just curious about it. – systempuntoout Jun 16 '10 at 12:43
up vote 3 down vote accepted

Question titles aren't markdown, they're plain text.

Accordingly, if you're going to display them in HTML you shouldn't display them "raw".

share|improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .