Common web attacks 7-cross-site scripting (XSS)

I learned these things in dvwa (Damn Vulnerable Web App). I installed dvwa in my free space. If you are interested, please check it out. DVWA

If you want a user name and password, you can contact me: sq371426@163.com

Dvwa is provided by google for verification. For details, see google CAPCTHE

The cross-site scripting attack means that the user publishes html/js Code on a message book similar to this. When this message is viewed, the script is executed.

We can see that there is no defense code

<? Php if (! Array_key_exists ("name", $ _ GET) | $ _ GET ['name'] = NULL | $ _ GET ['name'] = '') {$ isempty = true;} else {echo '<pre>'; echo 'Hello '. $ _ GET ['name']; echo '</pre>';}?>

Directly output data, if the user publishes"