StackOverflow2013

Note that there are some explanatory texts on larger screens.

plurals

POhtml() vs innerHTML jquery/javascript & XSS attacks
primarykey
Id
8318581
data
AcceptedAnswerId
8318820
AnswerCount
4
ClosedDate
CommentCount
2
CommunityOwnedDate
CreationDate
2011-11-29T22:22:13.533
FavoriteCount
2
LastActivityDate
2018-04-27T07:59:30.443
LastEditDate
LastEditorUserId
0
OwnerUserId
1054151
ParentId
0
PostTypeId
1
Score
8
ViewCount
15713
LastEditorDisplayName
text
Body
<p>I'm testing xss attacks on my own code. The example beneath is a simple box where an user can type whatever he wants. After pressing "test!" button, JS will show the input string into two divs.This is an example I made to explain better my question:</p> <pre><code><html> <script src="http://ajax.googleapis.com/ajax/libs/jquery/1.7.1/jquery.min.js"></script> <script type="text/javascript"> function testIt(){ var input = document.getElementById('input-test').value; var testHtml = document.getElementById('test-html'); var testInnerHTML = document.getElementById('test-innerHTML'); $(testHtml).html(input); testInnerHTML.innerHTML = input; } </script> <head>this is a test</head> <body> <input id="input-test" type="text" name="foo" /> <input type="button" onClick="testIt();" value="test!"/> <div id="test-html"> </div> <div id="test-innerHTML"> </div> </body> </code></pre> <p></p> <p>if you try to copy it into a .html file and run it, it will work fine, but if you try to input <code><script>alert('xss')</script></code>, only one alert box will be thrown: the one inside `test-html' div (with html() function).</p> <p>I really can't understand why this is happening, and also, inspecting the code with firebug gives me this result (after injecting the script)</p> <pre><code><body> this is a test <input id="input-test" type="text" name="foo"> <input type="button" value="test!" onclick="testIt();"> <div id="test-html"> </div> <div id="test-innerHTML"> <script> alert('xss') </script> </div> </body> </code></pre> <p>as you can see <code>test-html</code> div is empty, and <code>test-innerhtml</code> div contans the script. Can someone tell me why? Is because html() is more secure against scripts injection or something similar?</p> <p>Thanks in advance, best regards.</p>
Tags
<javascript><jquery><html><input><xss>
Title
html() vs innerHTML jquery/javascript & XSS attacks
singulars
PostAcceptedAnswerId
1. PO
  singulars
  PostTypePostTypeId
  PTAnswer
PostParentId
1. This table or related slice is empty.
PostTypePostTypeId
1. PTQuestion
UserLastEditorUserId
1. This table or related slice is empty.
UserOwnerUserId
1. USBeNdErR
plurals
PostLinksPostIdRelatedPostId
1. PL
  singulars
  LinkTypeLinkTypeId
  LTLinked
2. PL
  singulars
  LinkTypeLinkTypeId
  LTLinked
PostLinksRelatedPostIdPostId
1. PL
  singulars
  LinkTypeLinkTypeId
  LTLinked
2. PL
  singulars
  LinkTypeLinkTypeId
  LTDuplicate
PostsAcceptedAnswerId
1. This table or related slice is empty.
PostsParentIdCreationDate
1. PO
  singulars
  PostTypePostTypeId
  PTAnswer
2. PO
  singulars
  PostTypePostTypeId
  PTAnswer
3. PO
  singulars
  PostTypePostTypeId
  PTAnswer
VotesPostIdCreationDate
1. VO
  singulars
  PostPostId
  POhtml() vs innerHTML jquery/javascript & XSS attacks
  UserUserId
  This table or related slice is empty.
  VoteTypeVoteTypeId
  VTUpMod
2. VO
  singulars
  PostPostId
  POhtml() vs innerHTML jquery/javascript & XSS attacks
  UserUserId
  This table or related slice is empty.
  VoteTypeVoteTypeId
  VTUpMod
CommentsPostId
1. COYou don't have to worry about security as the user types, because whatever script they try to insert will only affect them at that point. What you do need to worry about is what happens when the entered text gets submitted to your webserver - if you're storing it in a database you need to be sure you don't just blindly concatenate the entered text on the end of an SQL query. If you later return previously entered text you need to be sure that the entered value is escaped so that, e.g., "<script>" becomes "<script>" and thus the browser won't recognise it as a script tag.
  singulars
  PostPostId
  POhtml() vs innerHTML jquery/javascript & XSS attacks
  UserUserId
  USnnnnnn
2. COHi nnnnnnn. XSS can occure even if the script never reaches the server. There are two types. Self-XSS where the user is tricked into typing something somehow, and then DOM-based XSS, which means the browser is using untrusted input directly in the browser, which never reaches the server. Typically this could be window.name, window.referer or data from after the # in the url. Lots of big sites around the web (wikipedia, aol, twitter) have had DOM based XSS.
  singulars
  PostPostId
  POhtml() vs innerHTML jquery/javascript & XSS attacks
  UserUserId
  USErlend

Querying!

Guidance

A row detail

Detail views are divided into sections. All the information in the data section comes from columns in the selected row. The other sections display data from other, related rows.

Related data can be related in a to-one or a to-many fashion. Captions of data related in a to-many fashion link to a list view showing a filtered view of the table.

Try moving around until you find a non-empty to-many entry and click on the label to get to one. You can move back to the root by clicking on the database name in the header.