hi im new here i want ask about how bypass filter is use str_replace to replace bracket < to [ .i found xss on site
but str_replace function replace < to [ so how to bypass encode not work .but self-xss work but i want store in in data bypass str_replace function?
Hi @rarsn,
can you share more context of the vulnerability?
Thank you for returning to my comment:slightly_smiling_face:
I mean the website use filter replace braket .code like str_replace(’<’, ‘[’, $_GET[‘name’]);
the vulnerability before filter self xss but i want make it store on comment but well replace
I tried event handler attributes not work uncoded not work 
