XSS attack Solution

A man who cannot cry

<Form name = "testform" method = "post" action = "news/comment. php">
<Input type = "text" name = "userName">
<Input type = "hidden" name = "test1"/>
<Input type = "hidden" name = "test2"/>
</Form>
If the data entered by the user is "/> <script src = xxx> </script>, a malicious script is inserted. solution: 1. Verify the type and length of the data entered by the user. Others, including URL, query keyword, HTTP header, get, and post, also require reliable input verification, this can defend against some malicious scripts, but cannot completely defend against them. 2. Try to use the POST method instead of the GET method to submit the form; filter the characters such as "<", ">", ";", and; encode is required before any content is output to the page. To avoid directly disclosing user privacy, use cookies in combination with other systems or user information to reduce the risk of leakage. 3. Note that if the injection code is to remove keywords such as src href, you need to help supplement the findings without the protocol header. Style needs to focus on processing/**/expression url, as far as possible to prohibit the style attribute, all styles are defined in CSS. 4. Minimize sensitive operations such as document writing on the client. Focus on the following methods: document. URL document. URLUnencoded document. location () document. referrer window. location () document. create... () layer-by-layer Filtering of client, server, and database access layers. Each layer filters data to minimize risks. The above is a simple summary of XSS attacks. I hope you can add more. A scan result is provided!