title: Potential jQuery XSS
body: <p>I maintain a PHP application.  A user has recently reported the following code is vulnerable to XSS.</p>
  
  <pre><code>from_name = jQuery("#from_name").val();
  from_email = jQuery("#from_email").val();
  subject = jQuery("#subject").val();
  msg = "From: " + from_name + " (" + from_email + ")&lt;br /&gt;";
  msg = msg + "Subject: " + subject;
  jQuery("#review").html(msg);
  </code></pre>
  
  <p>His suggestion follows.</p>
  
  <pre><code>from_name = jQuery("#from_name").val();
  from_email = jQuery("#from_email").val();
  subject = jQuery("#subject").val();
  msg = "From: " + from_name.replace(/&lt;/g,"&amp;lt;").replace(/&gt;/g,"&amp;gt;") + " (" + from_email.replace(/&lt;/g,"&amp;lt;").replace(/&gt;/g,"&amp;gt;") + ")&lt;br /&gt;";
  msg = msg + "Subject: " + subject.replace(/&lt;/g,"&amp;lt;").replace(/&gt;/g,"&amp;gt;");
  jQuery("#review").html(msg);
  </code></pre>
  
  <p>If it isn't obvious, this is significantly simplified.  Regardless, his solution is just to clean up potential elements with <code>.replace(/&lt;/g,"&amp;lt;").replace(/&gt;/g,"&amp;gt;")</code> which I don't immediately have a problem with but seems either A) unnecessary or B) incomplete.</p>
  
  <p>I've considered using <code>.text</code> instead of <code>.html</code> but then I can't format my text appropriately.  Unless I'm overlooking something stupid.</p>
  
  <p>I can see how it might be vulnerable since the originating elements are input elements, but those input elements are filled from a database.  The database was filled originally using $_POST, which is vulnerable, but I validate the data before committing it to the database, including stripping all HTML tags.</p>
  
  <p>In my opinion, the only chance for XSS is literally on the page if the element is altered by the user (seems stupid) or JavaScript, either way, my review element could be temporarily compromised, but once the change is 'saved' my validation functions would strip out the malicious changes.</p>
  
  <p>This is a long winded question, I hope my logic is reasonable.</p>