I just thought I'd let everyone know that I found a bug in the comments (and possibly questions as well). I went to post a comment in webmasters and I put < noscript > in it and instead of it just showing the tag, it parsed it as actual HTML. I am not sure if this can lead to XSS but I am not leaving that to doubt. Please fix this.
What is meta?
- Any Stack Exchange user can ask a question
- The community provides support, votes on ideas, and reports bugs
- Your voice helps shape the way Stack Exchange operates
There's no HTML allowed in comments. This includes all tags and (sadly) character references.
Since you wrote
and you used the
and you inspected the HTML code in the developer tools (or whatever it's called in your browser).
Indeed, Chrome shows the following: