title: HTML Encoding Form Post
body: <p>A user has sent me some information that they posted to one of my pages with potential XSS issues however, looking at the server side code I don't think it would ever run through my code smoothly.</p>
  
  <p>They said they sent this:</p>
  
  <pre><code>forminfo=%27+%7C%7C+%27%27+%7C%7C+%27%25booleantest%3Atrue%2Ctrue%2Ctrue
  </code></pre>
  
  <p>I have looked at this and have worked out that %27 is a Apostrophy and %7C is a Pipe character which could be risky.</p>
  
  <p>However if the data comes into my app in that format it will crash as it does string manipulation on the posted information. It does a string split on a colon (:) character.  forminfo is the name of one of my HTML input elements</p>
  
  <p>If it came in as </p>
  
  <pre><code>forminfo=' || '' || '%booleantest:true,true,true
  </code></pre>
  
  <p>then its more clear and I can see better what they sent and how the code would deal with the input.</p>
  
  <p>Therfore are they saying that they posted data in an encrypted manner?  Would my app know how to deal with the encrypted posted data and unencrypt it somehow?  </p>
  
  <p>They didn't get an error but if I run the code myself it errors. </p>
  
  <p>Can you explain what might have happened?</p>