<html>
<script>
/*
var a = new Array;//相当于[]
alert(a.constructor == Array);//结果为true
a.constructor.constructor('alert(12345)')()
*/
// [].constructor.constructor('alert(12345)')()
[]['constructor']['constructor']('alert(12345)')()
</script>
</html>在js中，
[]['constructor']['constructor']('alert(12345)')()[].constructor.constructor('alert(12345)')()Array.constructor('alert(12345)')()
Array.constructor('<span style="font-family: Arial, Helvetica, sans-serif;">alert(12345)</span>')
alert(12345)
扫一扫
1万+
被折叠的 条评论
为什么被折叠?
到【灌水乐园】发言
