Do I need to sanitize the callback parameter from a JSONP call?
- by christian studer
I would like to offer a webservice via JSONP and was wondering, if I need to sanitize the value from the callback parameter.
My current server side script looks like this currently (More or less. Code is in PHP, but could be anything really.):
header("Content-type: application/javascript");
echo $_GET['callback'] . '(' . json_encode($data) . ')';
This is a classic XSS-vulnerability.
If I need to sanitize it, then how? I was unable to find enough information about what might be allowed callback strings.