Hacker News new | ask | show | jobs
by xss-game-bot 4401 days ago
What payload are you using on that level? Keep in mind that ";" is often treated as a parameter separator in URLs, similarly to &. If you put it into the mock URL bar it will terminate the value of your parameter (see also http://en.wikipedia.org/wiki/Query_string#Web_forms)

PS. Consider it reported, thanks!

1 comments

Escaping the ';' works on that one
Also using the ',' operator works.