mu #6

Wait is apioforum vulnerable to XSS? Mods do you mind if I test in a separate thread?

presumably only innocent tags are allowed, like marquee.

<><script>alert('a')</script>

i don't understand why people keep testing this, the code is right here

img is not an innocent tag. it has scriptoid attributes. like onerror=.

The code is blocking certain attributes