My friend is kind of web-developer, beginner. I noticed that he didn't purify his user input on form submission, so I could easily save to his DB working <script>alert();</script>.

After some nice trolling with JavaScript, he changed his code to swap any < character to s. So for example writing <script>alert();</script> would save to DB as sscript>alert();s/script>.

As being friend, I want to show that this is not the solution, and here goes the question - Is it possible to void JavaScript, when this kind of "security" is used?

  • Is he doing the string update using JavaScript? Most browsers have the option to disable JavaScript. What would happen then?
    – Dave
    Feb 12 '14 at 10:41

JavaScript should not be used for security, never! JavaScript can easily be turned of. It is good for client validation, but everything related to security should be done on server side, and that includes filtering the inputs.

  • Why would be be saving javascript code to the database?
    – Steve
    Feb 11 '14 at 21:30
  • @Steve - cross site scripting attacks?
    – Dave
    Feb 12 '14 at 10:40

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.