[GH-ISSUE #1412] Single quotes in scanned SSIDs do not correctly populate the SSID box when clicked #1209

New issue

Closed

opened 2026-02-28 01:29:02 +03:00 by kerem · 0 comments

kerem commented

2026-02-28 01:29:02 +03:00

Owner

Originally created by @abryant on GitHub (May 7, 2022).
Original GitHub issue: https://github.com/tzapu/WiFiManager/issues/1412

Basic Infos

Hardware

WiFimanager Branch/Release: master
Esp8266/Esp32: ESP32
Hardware: ESP32-WROVER-E
Core Version: 2.4.0

Description

My SSID is something like: '); DROP TABLE WIFI; -- (inspired by https://xkcd.com/327/)

This seems to be broken because the data-ssid attribute isn't templated correctly if the SSID contains a '. Chrome's inspector gives me this as the parsed element:

<a href="#p" onclick="c(this)" data-ssid="" );="" drop="" table="" wifi;="" --'="">');&nbsp;DROP&nbsp;TABLE&nbsp;WIFI;&nbsp;--</a>

Because the data-ssid attribute is empty, it falls back to using innerText, which has spaces replaced by   so it doesn't connect (instead, it fails with WL_NO_SSID_AVAIL).

Originally created by @abryant on GitHub (May 7, 2022). Original GitHub issue: https://github.com/tzapu/WiFiManager/issues/1412 ### Basic Infos #### Hardware WiFimanager Branch/Release: master Esp8266/Esp32: ESP32 Hardware: ESP32-WROVER-E Core Version: 2.4.0 ### Description My SSID is something like: `'); DROP TABLE WIFI; --` (inspired by https://xkcd.com/327/) This seems to be broken because the `data-ssid` attribute isn't templated correctly if the SSID contains a `'`. Chrome's inspector gives me this as the parsed <a> element: ``` <a href="#p" onclick="c(this)" data-ssid="" );="" drop="" table="" wifi;="" --'="">'); DROP TABLE WIFI; --</a> ``` Because the `data-ssid` attribute is empty, it falls back to using `innerText`, which has spaces replaced by ` ` so it doesn't connect (instead, it fails with WL_NO_SSID_AVAIL).