Questions tagged [xss]

Cross-site scripting (XSS) is a type of computer security vulnerability typically found in web applications that enables malicious attackers to inject client-side script into web pages viewed by other users. An exploited cross-site scripting vulnerability can be used by attackers to bypass access controls such as the same origin policy.

xss
Filter by
Sorted by
Tagged with
1282 votes
15 answers
684k views

How can I sanitize user input with PHP?

Is there a catchall function somewhere that works well for sanitizing user input for SQL injection and XSS attacks, while still allowing certain types of HTML tags?
Brent's user avatar
  • 23.6k
312 votes
9 answers
343k views

How can I prevent XSS with HTML/PHP?

How do I prevent XSS (cross-site scripting) using just HTML and PHP? I've seen numerous other posts on this topic, but I have not found an article that clear and concisely states how to actually ...
TimTim's user avatar
  • 3,251
232 votes
6 answers
365k views

What is the http-header "X-XSS-Protection"?

So I've been toying around with HTTP for fun in telnet now (i.e. just typing in telnet google.com 80 and putting in random GETs and POSTs with different headers and the like) but I've come across ...
midc111's user avatar
  • 2,353
202 votes
2 answers
109k views

What does it mean when they say React is XSS protected?

I read this on the React tutorial. What does this mean? React is safe. We are not generating HTML strings so XSS protection is the default. How do XSS attacks work if React is safe? How is this ...
user1210233's user avatar
  • 2,840
143 votes
15 answers
175k views

How to pass parameters to a Script tag?

I read the tutorial DIY widgets - How to embed your site on another site for XSS Widgets by Dr. Nic. I'm looking for a way to pass parameters to the script tag. For example, to make the following work:...
Tomer Lichtash's user avatar
133 votes
10 answers
173k views

WARNING: sanitizing unsafe style value url

I want to set the background image of a DIV in a Component Template in my Angular 2 app. However I keep getting the following warning in my console and I don't get the desired effect... I am unsure if ...
Mark Sandman's user avatar
  • 3,323
116 votes
6 answers
72k views

Do htmlspecialchars and mysql_real_escape_string keep my PHP code safe from injection?

Earlier today a question was asked regarding input validation strategies in web apps. The top answer, at time of writing, suggests in PHP just using htmlspecialchars and mysql_real_escape_string. ...
Cheekysoft's user avatar
  • 35.4k
107 votes
11 answers
153k views

How do you set up use HttpOnly cookies in PHP

How can I set the cookies in my PHP apps as HttpOnly cookies?
Scott Warren's user avatar
  • 1,089
103 votes
3 answers
186k views

How do you use window.postMessage across domains?

It seems like the point of window.postMessage is to allow safe communication between windows/frames hosted on different domains, but it doesn't actually seem to allow that in Chrome. Here's the ...
Kevin Montrose's user avatar
83 votes
10 answers
169k views

XSS prevention in JSP/Servlet web application

How can I prevent XSS attacks in a JSP/Servlet web application?
newbie's user avatar
  • 24.5k
82 votes
12 answers
70k views

Best way to handle security and avoid XSS with user entered URLs

We have a high security application and we want to allow users to enter URLs that other users will see. This introduces a high risk of XSS hacks - a user could potentially enter javascript that ...
Keith's user avatar
  • 153k
82 votes
2 answers
42k views

What are "top level JSON arrays" and why are they a security risk?

In the video below, at time marker 21:40, the Microsoft PDC presenter says it's important that all JSON be wrapped so it's not a top level array: https://channel9.msdn.com/Events/PDC/PDC09/FT12 What ...
makerofthings7's user avatar
77 votes
10 answers
193k views

How do you configure HttpOnly cookies in tomcat / java webapps?

After reading Jeff's blog post on Protecting Your Cookies: HttpOnly. I'd like to implement HttpOnly cookies in my web application. How do you tell tomcat to use http only cookies for sessions?
ScArcher2's user avatar
  • 86.6k
76 votes
7 answers
187k views

Sanitizing user input before adding it to the DOM in Javascript

I'm writing the JS for a chat application I'm working on in my free time, and I need to have HTML identifiers that change according to user submitted data. This is usually something conceptually shaky ...
I GIVE TERRIBLE ADVICE's user avatar
75 votes
5 answers
112k views

Allow All Content Security Policy?

Is it possible to configure the Content-Security-Policy to not block anything at all? I'm running a computer security class, and our web hacking project is running into issues on newer versions of ...
joshlf's user avatar
  • 22.7k
74 votes
10 answers
73k views

Preventing XSS in Node.js / server side javascript

Any idea how one would go about preventing XSS attacks on a node.js app? Any libs out there that handle removing javascript in hrefs, onclick attributes,etc. from POSTed data? I don't want to have to ...
Techwraith's user avatar
  • 1,308
73 votes
3 answers
111k views

How can I properly escape HTML form input default values in PHP?

Given the following two HTML/PHP snippets: <input type="text" name="firstname" value="<?php echo $_POST['firstname']; ?>" /> and <textarea name="...
Ryan's user avatar
  • 5,933
70 votes
9 answers
68k views

Will HTML Encoding prevent all kinds of XSS attacks?

I am not concerned about other kinds of attacks. Just want to know whether HTML Encode can prevent all kinds of XSS attacks. Is there some way to do an XSS attack even if HTML Encode is used?
Niyaz's user avatar
  • 54.4k
68 votes
20 answers
29k views

What are the best practices for avoiding xss attacks in a PHP site [closed]

I have PHP configured so that magic quotes are on and register globals are off. I do my best to always call htmlentities() for anything I am outputing that is derived from user input. I also ...
Rik Heywood's user avatar
  • 13.8k
68 votes
14 answers
28k views

When is it best to sanitize user input?

User equals untrustworthy. Never trust untrustworthy user's input. I get that. However, I am wondering when the best time to sanitize input is. For example, do you blindly store user input and then ...
Aaron's user avatar
  • 23.6k
66 votes
6 answers
43k views

Is jQuery .text() method XSS safe?

I have unescaped data from users. So is it safe to use like this: var data = '<test>a&f"#</test>'; // example data from ajax response if (typeof(data) === 'string') $('body')....
Vytautas's user avatar
  • 3,539
64 votes
7 answers
55k views

Sanitising user input using Python

What is the best way to sanitize user input for a Python-based web application? Is there a single function to remove HTML characters and any other necessary characters combinations to prevent an XSS ...
Steve's user avatar
  • 1,879
63 votes
8 answers
119k views

How do I prevent people from doing XSS in Spring MVC?

What should I do to prevent XSS in Spring MVC? Right now I am just putting all places where I output user text into JSTL <c:out> tags or fn:escapeXml() functions, but this seems error prone as I ...
Doug's user avatar
  • 813
62 votes
5 answers
67k views

The ultimate clean/secure function

I have a lot of user inputs from $_GET and $_POST... At the moment I always write mysql_real_escape_string($_GET['var']).. I would like to know whether you could make a function that secures, escapes ...
Karem's user avatar
  • 17.9k
59 votes
3 answers
51k views

CSRF, XSS and SQL Injection attack prevention in JSF

I have a web application built on JSF with MySQL as DB. I have already implemented the code to prevent CSRF in my application. Now since my underlying framework is JSF, I guess I don't have to handle ...
AngelsandDemons's user avatar
57 votes
6 answers
26k views

Is strip_tags() vulnerable to scripting attacks?

Is there a known XSS or other attack that makes it past a $content = "some HTML code"; $content = strip_tags($content); echo $content; ? The manual has a warning: This function does not ...
Pekka's user avatar
  • 446k
57 votes
2 answers
68k views

Cross Site Scripting in CSS Stylesheets

Is it possible to use cross site scripting in a CSS stylesheet? For example a reference stylesheet contains malicious code, how would you do this? I know you can use style tags but what about ...
Johnny's user avatar
  • 1,973
54 votes
4 answers
142k views

How exactly do you configure httpOnlyCookies in ASP.NET?

Inspired by this CodingHorror article, "Protecting Your Cookies: HttpOnly" How do you set this property? Somewhere in the web config?
Teller's user avatar
  • 765
53 votes
5 answers
30k views

What is the difference between AntiXss.HtmlEncode and HttpUtility.HtmlEncode?

I just ran across a question with an answer suggesting the AntiXss library to avoid cross site scripting. Sounded interesting, reading the msdn blog, it appears to just provide an HtmlEncode() method. ...
g .'s user avatar
  • 8,210
52 votes
5 answers
21k views

Today's XSS onmouseover exploit on twitter.com

Can you explain what exactly happened on Twitter today? Basically the exploit was causing people to post a tweet containing this link: http://t.co/@"style="font-size:999999999999px;"onmouseover="$....
ibz's user avatar
  • 45.4k
52 votes
3 answers
72k views

Is it safe to use $.support.cors = true; in jQuery?

I was trying to hit a web service on a different domain using jQuery's ajax method. After doing some research it looks like it does not allow this is by design to prevent cross site scripting. I ...
Abe Miessler's user avatar
  • 83.8k
48 votes
8 answers
94k views

Chrome: ERR_BLOCKED_BY_XSS_AUDITOR details

I'm getting this chrome flag when trying to post and then get a simple form. The problem is that the Developer Console shows nothing about this and I cannot find the source of the problem by myself. ...
piraces's user avatar
  • 1,338
48 votes
4 answers
6k views

Is it really insecure to build HTML strings in Javascript?

The company who hosts our site reviews our code before deploying - they've recently told us this: HTML strings should never be directly manipulated, as that opens us up to potential XSS holes. ...
And Finally's user avatar
  • 5,662
47 votes
10 answers
122k views

XSS filtering function in PHP

Does anyone know of a good function out there for filtering generic input from forms? Zend_Filter_input seems to require prior knowledge of the contents of the input and I'm concerned that using ...
codecowboy's user avatar
  • 9,965
46 votes
5 answers
4k views

Can someone explain this SQL injection attack to me?

I wanted to post this here as it is very much coding related and was something I had to clean up this week on one of my company's old ASP (classic) sites. We got hit with the SQL injection attack ...
Jakub's user avatar
  • 20.4k
45 votes
3 answers
48k views

IE8 XSS filter: what does it really do?

Internet Explorer 8 has a new security feature, an XSS filter that tries to intercept cross-site scripting attempts. It's described this way: The XSS Filter, a feature new to Internet Explorer 8,...
Ned Batchelder's user avatar
45 votes
6 answers
62k views

HTML: Should I encode greater than or not? ( > &gt; )

When encoding possibly unsafe data, is there a reason to encode >? It validates either way. The browser interprets the same either way, (In the cases of attr="data", attr='data', <tag>data&...
700 Software's user avatar
  • 86.5k
45 votes
2 answers
27k views

Which browsers do support HttpOnly cookies?

Which browsers do support HttpOnly cookies, and since which version? Please see http://www.codinghorror.com/blog/archives/001167.html for a discussion of HttpOnly cookies and XSS-prevention.
43 votes
6 answers
57k views

Why this error in dev console of chrome when using x-xss-protection?

How to fix this error in console? Error parsing header X-XSS-Protection: 1; mode=block, 1; mode=block:expected semicolon at character position 14. The default protections will be applied.
Vamsi Krishna's user avatar
42 votes
7 answers
39k views

Turning an SVG string into an image in a React component

I have a dynamically generated SVG string in a React component. I want to embed this as an image in the component. Currently, I'm using something along the lines of: class SomeComponent extends React....
James Paterson's user avatar
42 votes
9 answers
17k views

Why the cross-domain Ajax is a security concern?

Why was it decided that using XMLHTTPRequest for doing XML calls should not do calls across the domain boundary? You can retrieve JavaScript, images, CSS, iframes, and just about any other content I ...
Kibbee's user avatar
  • 65.9k
42 votes
4 answers
85k views

Is it possible to XSS exploit JSON responses with proper JavaScript string escaping?

JSON responses can be exploited by overriding Array constructors or if hostile values are not JavaScript string-escaped. Let's assume both of those vectors are addressed in the normal way. Google ...
Chris Mountford's user avatar
41 votes
5 answers
84k views

How to sanitize HTML code in Java to prevent XSS attacks?

I'm looking for class/util etc. to sanitize HTML code i.e. remove dangerous tags, attributes and values to avoid XSS and similar attacks. I get html code from rich text editor (e.g. TinyMCE) but it ...
WildWezyr's user avatar
  • 10.5k
41 votes
3 answers
30k views

What is Cross Site Script Inclusion (XSSI)?

I've recently seen XSSI mentioned on multiple pages, e.g. Web Application Exploits and Defenses: Browsers prevent pages of one domain from reading pages in other domains. But they do not prevent ...
Pankrat's user avatar
  • 5,286
41 votes
3 answers
138k views

Error: Permission denied to access property "document"

I have a HTML Document which contains an iframe. Whenever I try to access or modify this iframe with JS I get Error: Permission denied to access property "document". I am using frame.contentWindow....
sbrm1's user avatar
  • 1,225
40 votes
6 answers
25k views

PHP_SELF and XSS

I've found an article claiming that $_SERVER['PHP_SELF'] is vulnerable to XSS. I'm not sure if I have understood it correctly, but I'm almost sure that it's wrong. How can this be vulnerable to XSS ...
McRonald's user avatar
  • 1,005
40 votes
3 answers
116k views

Java Best Practices to Prevent Cross Site Scripting [closed]

I have gone through the OWASP top ten vulnerabilities and found that Cross-Site Scripting is the one we have to take notes. There was few way recommended solutions. One has stated that Do not use "...
user avatar
40 votes
4 answers
23k views

Is FILTER_SANITIZE_EMAIL pointless if already using FILTER_VALIDATE_EMAIL?

I am just creating a registration form, and I am looking only to insert valid and safe emails into the database. Several sites (including w3schools) recommend running FILTER_SANITIZE_EMAIL before ...
Alex's user avatar
  • 401
40 votes
2 answers
13k views

How to safely run user-supplied Javascript code inside the browser?

Imagine a scenario where I want to continuously invoke user-supplied Javascript code, like in the following example, where getUserResult is a function that some user (not myself) has written: for (...
Domi's user avatar
  • 23.4k
38 votes
2 answers
52k views

Input sanitization in ReactJS

I am using ReactJS do develop a simple chat application. Could someone help me to sanitize the input . There is only one input text box to send chat messages. How to sanitize it?. <input type="...
Shamnad P S's user avatar
  • 1,145

1
2 3 4 5
90