String replace is XSS’s friend. Trust me.
String replace is actually a really common problem. Blwood discovered some XSS vulnerabilities in Tikiwiki. Here’s the premise. If the string “<SCRIPT>” is removed and you can use that to your advantage by entering something like “<sc<SCRIPT>ript>” which when “<SCRIPT>” is removed you get “<script>”. That’s bad. Bad, and common.
