Practice · 1 of 3

Sink or Safe

Write isDangerousSink(line) — return true when the line writes data into an execution context: contains "innerHTML =", "outerHTML =", "document.write(", or "eval(". Assignment via += also counts. Ordinary DOM creation (createElement/textContent) is safe.

Difficulty: intermediate

Press Submit to check your solution.

Back to lesson: Practice: XSS Sinks & Encoding — Practice