What is the general concept behind XSS?

by

As the answers on how XSS can be malicious are already given, I’ll only answer the following question left unanswered:

how can i prevent XSS from happening on my websites ?

As to preventing from XSS, you need to HTML-escape any user-controlled input when they’re about to be redisplayed on the page. This includes request headers, request parameters and any stored user-controlled input which is to be served from a database. Especially the <, >, " and ' needs to be escaped, because it can malform the surrounding HTML code where this input is been redisplayed.

Almost any view technolgy provides builtin ways to escape HTML (or XML, that’s also sufficient) entities.

In PHP you can do that with htmlspecialchars(). E.g.

<input name="foo" value="<?php echo htmlspecialchars($foo); ?>">

If you need to escape singlequotes with this as well, you’ll need to supply the ENT_QUOTES argument, also see the aforelinked PHP documentation.

In JSP you can do that with JSTL <c:out> or fn:escapeXml(). E.g.

<input name="foo" value="<c:out value="${param.foo}" />">

or

<input name="foo" value="${fn:escapeXml(param.foo)}">

Note that you actually don’t need to escape XSS during request processing, but only during response processing. Escaping during request processing is not needed and it may malform the user input sooner or later (and as being a site admin you’d also like to know what the user in question has actually entered so that you can take social actions if necessary). With regard to SQL injections, just only escape it during request processing at the moment when the data is about to be persisted in the database.

More Related Contents:

  1. When is it best to sanitize user input?
  2. AntiXSS in ASP.Net Core
  3. How does XSS work?
  4. How to prevent XSS with HTML/PHP?
  5. CSRF, XSS and SQL Injection attack prevention in JSF
  6. What are the best practices for avoiding xss attacks in a PHP site [closed]
  7. Do htmlspecialchars and mysql_real_escape_string keep my PHP code safe from injection?
  8. PHP_SELF and XSS
  9. Best way to handle security and avoid XSS with user entered URLs
  10. What are “top level JSON arrays” and why are they a security risk?
  11. Sanitizing user input before adding it to the DOM in Javascript
  12. Will HTML Encoding prevent all kinds of XSS attacks?
  13. What is cross site scripting?
  14. Cross Site Scripting in CSS Stylesheets
  15. How do I prevent people from doing XSS in Spring MVC?
  16. Why the cross-domain Ajax is a security concern?
  17. How do you use window.postMessage across domains?
  18. Cross-site AJAX requests
  19. What does it mean when they say React is XSS protected?
  20. CodeIgniter – why use xss_clean
  21. When the bots attack! [closed]
  22. Spam Prevention/Reduction – Contact Form?
  23. Is it safe to use $.support.cors = true; in jQuery?
  24. How do you configure HttpOnly cookies in tomcat / java webapps?
  25. What is the http-header “X-XSS-Protection”?
  26. XSS attacks and style attributes
  27. HTML/XSS escape on input vs output
  28. Reliably detecting PhantomJS-based spam bots
  29. How to protect html form from spammers?
  30. Hunting cheaters in a voting competition

Leave a Comment