XSS prevents attacks where a malicious user executes the input information as HTML or JS code by changing the information entered by the user into text format, or special symbol escaping

XSS prevents attacks where a malicious user executes the input information as HTML or JS code by changing the information entered by the user into text format, or special symbol escaping

Prevention of XSS attack

The harm caused by XSS attacks occurs because the user's input becomes executable code, so we are going to HTML-escape the user's input by escaping the special characters, such as angle brackets, quotation marks, single quotation marks, and so on, for example, "" After escaping "<", ">" After escape is ">", "'" is escaped after "&", "" "is escaped after" " "

1, will be able to be converted into HTML input content, when writing code instead of innertext instead of innerHTML

2, there is no way to use the following methods of the case (JS code)

function Safestr (str) {
Return str.replace (/</g, ' &lt; '). Replace (/>/g, ' &gt; '). Replace (/"/g," &quot; "). Replace (/'/g, ' & #039; ');
}

Third, XSS defense

We are in a contradictory world, with spears there are shields. As long as there is no vulnerability in our code, the attacker will not be possible, we will make an egg that is not sewn. XSS bug Fix principle: Do not trust the data entered by the customer Note: The attack code does not necessarily mark important cookies as HTTP only in <script></script>, so that the document in JavaScript     A cookie cannot be obtained by a cookie statement. The user's input needs to be processed, allowing the user to enter only the data we expect, and the other values are filtered out. For example: In a TextBox of age, only users are allowed to enter numbers.　　and the characters outside the numbers are filtered out. HTML Encode processing of data filters or removes special HTML tags, such as: <script>, <iframe>, &lt; for <, &gt; For &quot, the label for the filter JavaScript event. such as "onclick=", "onfocus" and so on. The specific defenses for XSS are as follows:

XSS prevents attacks where a malicious user executes the input information as HTML or JS code by changing the information entered by the user into text format, or special symbol escaping