Javascript injection

X-Received	by 10.36.200.2 with SMTP id w2mr8892733itf.6.1472450289009; Sun, 28 Aug 2016 22:58:09 -0700 (PDT)
X-Received	by 10.157.57.194 with SMTP id y60mr831973otb.20.1472450288918; Sun, 28 Aug 2016 22:58:08 -0700 (PDT)
Path	csiph.com!usenet.blueworldhosting.com!feeder01.blueworldhosting.com!peer01.iad.highwinds-media.com!news.highwinds-media.com!feed-me.highwinds-media.com!border1.nntp.dca1.giganews.com!nntp.giganews.com!j128no784936ith.0!news-out.google.com!b4ni3242iti.0!nntp.google.com!x131no790632ite.0!postnews.google.com!glegroupsg2000goo.googlegroups.com!not-for-mail
Newsgroups	comp.lang.javascript
Date	Sun, 28 Aug 2016 22:58:08 -0700 (PDT)
Complaints-To	groups-abuse@google.com
Injection-Info	glegroupsg2000goo.googlegroups.com; posting-host=180.215.64.169; posting-account=F-wi_QoAAAA9QfTnY622qw_s40JoHA-5
NNTP-Posting-Host	180.215.64.169
User-Agent	G2/1.0
MIME-Version	1.0
Message-ID	<2a5cf91a-151b-4379-9510-5dcd5a5bb196@googlegroups.com> (permalink)
Subject	Javascript injection
From	bit-naughty@hotmail.com
Injection-Date	Mon, 29 Aug 2016 05:58:08 +0000
Content-Type	text/plain; charset=UTF-8
Content-Transfer-Encoding	quoted-printable
Lines	10
X-Received-Bytes	1615
X-Received-Body-CRC	2781184424
Xref	csiph.com comp.lang.javascript:31202

Show key headers only | View raw

If I have a "forum" type of site, where stuff is being posted, and stored in the backend (in a MySQL database, using PHP), say,....can anyone type in Javascript into the post to accomplish naughty things? What's the most nefarious thing anyone can do? All I can think of is that someone would deface the page somehow, that *that* post is on, which, really, I can't see the point of..... Anything else?
...and how do I protect against it? (the post will probably be displayed inside a DIV on the page, I think....)


Thanks.

Back to comp.lang.javascript | Previous | Next — Next in thread | Find similar | Unroll thread

Thread

Javascript injection bit-naughty@hotmail.com - 2016-08-28 22:58 -0700
  Re: Javascript injection "Christoph M. Becker" <cmbecker69@arcor.de> - 2016-08-29 11:27 +0200
  Re: Javascript injection Hans-Georg Michna <hans-georgNoEmailPlease@michna.com> - 2016-08-29 15:58 +0200
    Re: Javascript injection "Evertjan." <exxjxw.hannivoort@inter.nl.net> - 2016-08-29 17:10 +0200
      Re: Javascript injection Aleksandro <aleksandro@gmx.com> - 2016-08-30 16:35 -0300
        Re: Javascript injection "Evertjan." <exxjxw.hannivoort@inter.nl.net> - 2016-08-31 10:25 +0200
          Re: Javascript injection "Christoph M. Becker" <cmbecker69@arcor.de> - 2016-08-31 12:43 +0200

csiph-web