1

Question's title attribute is not HTML encoded.

Examples:
http://api.stackoverflow.com/0.8/questions/456815?body=true&answers=true

 title: "Problems with HTML <marquee> tag"

http://api.stackoverflow.com/0.8/questions/2233564?body=true&answers=true

 title: "<Canvas>  contents as data?"

I found it when on my app i saw a scrolling word due to the <marquee> tag on the title :).

In a very remote way, this could be a problem, because afaik there are no constraints on question's title submission.
I could forge a question title (300 chars max) like:

What this script <script>evil_script_that_steal_your_stackexchange_webapp_cookies();</script> does?
  • I have noticed that from long time, and I was thinking it is by-design :P (may be not), and encoding myself for following 3 chars &, ", < in order. – YOU Jun 16 '10 at 7:53
  • @S.Mark me too, just curious about it. – systempuntoout Jun 16 '10 at 12:43
3

Question titles aren't markdown, they're plain text.

Accordingly, if you're going to display them in HTML you shouldn't display them "raw".

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .