Acronym for Cross Site Scripting.
2
votes
1answer
255 views
Pass IMG SRC via GET and echo it? Is that really secure?
I was wondering how I can make a really simple GET and echo request more secure
The code:
$src = $_GET['src'];
echo "<img src='$src' />";
Basically, I have a URL like ...
3
votes
1answer
350 views
Is this safe? <a href=http://javascript:…>
I wonder if href and src attributes on <a> and <img> tags are always safe w.r.t. XSS attacks, if they start with http:// or https://.
For example, is it possible to append javascript: ... ...
9
votes
5answers
1k views
How can I prevent a power user from calling my ajax functions?
I have a site that uses ajax calls to perform a number of functions. They have the webbrowser call back to a script - ajax.php. Though I use post data to transmit the data and limit the commands ...
2
votes
4answers
171 views
How to explain XSS to common web owner/user?
How would you explain cross-site scripting vulnerability to a non-programmer (common web user)?
