Take the 2-minute tour ×
Stack Apps is a question and answer site for apps, scripts, and development with the Stack Exchange API. It's 100% free, no registration required.

Question's title attribute is not HTML encoded.

Examples:
http://api.stackoverflow.com/0.8/questions/456815?body=true&answers=true

 title: "Problems with HTML <marquee> tag"

http://api.stackoverflow.com/0.8/questions/2233564?body=true&answers=true

 title: "<Canvas>  contents as data?"

I found it when on my app i saw a scrolling word due to the <marquee> tag on the title :).

In a very remote way, this could be a problem, because afaik there are no constraints on question's title submission.
I could forge a question title (300 chars max) like:

What this script <script>evil_script_that_steal_your_stackexchange_webapp_cookies();</script> does?
share|improve this question
    
I have noticed that from long time, and I was thinking it is by-design :P (may be not), and encoding myself for following 3 chars &, ", < in order. –  YOU Jun 16 '10 at 7:53
    
@S.Mark me too, just curious about it. –  systempuntoout Jun 16 '10 at 12:43

1 Answer 1

up vote 3 down vote accepted

Question titles aren't markdown, they're plain text.

Accordingly, if you're going to display them in HTML you shouldn't display them "raw".

share|improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .