Hacker News Reader

And another:

Edit: Using a bit.ly link, since HN's URL parser is leaving out the closing ].

but that doesn't work?

It does. If you look closely, you'll see that HN's URL parser ignored the ] at the end of the URL. If you click on the URL and then add a ] to the end of it, your JSON will be valid and you'll see two alert boxes.

Edit: But yeah, my bad for not noticing that earlier. I've swapped it out for a bit.ly link now, so it works properly. I'm headed to sleep. :)

It shouldn't affect the feed though (at least it doesn't seem like it)

That isn't the goal of an XSS attack. :P

http://en.wikipedia.org/wiki/Cross-site_scripting

Thanks for your help!

This one is fixed :)

It actually isn't. This example won't execute on page load, but it will if someone clicks in the search box.

http://fluin.com/?search=Search%22%20onclick=alert%28documen...

Since you're using PHP, I recommend you use a function like htmlspecialchars here rather than whatever kind of filtering you're doing.

thanks! I'll have that fixed