Which XSS attacks could be done when redirecting with window.location
and user input data.
I think this ones
- User can write a post with a title that contains
http://
so the end user ends up on a bad site. - User can write a post with title "
javascript:EvilCode()
" I think this will be executed in some browsers?
window.location.href = Post_Title;
does not make any sense, because the post title is not a URL? If the post title is only a part of the URL, you will have to URL encode it anyway