Take the 2-minute tour ×
Webmasters Stack Exchange is a question and answer site for pro webmasters. It's 100% free, no registration required.

My friend is kind of web-developer, beginner. I noticed that he didn't purify his user input on form submission, so I could easily save to his DB working <script>alert();</script>.

After some nice trolling with JavaScript, he changed his code to swap any < character to s. So for example writing <script>alert();</script> would save to DB as sscript>alert();s/script>.

As being friend, I want to show that this is not the solution, and here goes the question - Is it possible to void JavaScript, when this kind of "security" is used?

share|improve this question
    
Is he doing the string update using JavaScript? Most browsers have the option to disable JavaScript. What would happen then? –  Dave Rook Feb 12 at 10:41
add comment

1 Answer 1

up vote 1 down vote accepted

JavaScript should not be used for security, never! JavaScript can easily be turned of. It is good for client validation, but everything related to security should be done on server side, and that includes filtering the inputs.

share|improve this answer
    
Why would be be saving javascript code to the database? –  Steve Feb 11 at 21:30
    
@Steve - cross site scripting attacks? –  Dave Rook Feb 12 at 10:40
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.