Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]
Groups > comp.lang.javascript > #31204
| Path | csiph.com!feeder.erje.net!1.eu.feeder.erje.net!news.unit0.net!weretis.net!feeder1.news.weretis.net!news.solani.org!.POSTED!not-for-mail |
|---|---|
| From | "Christoph M. Becker" <cmbecker69@arcor.de> |
| Newsgroups | comp.lang.javascript |
| Subject | Re: Javascript injection |
| Date | Mon, 29 Aug 2016 11:27:34 +0200 |
| Organization | solani.org |
| Lines | 9 |
| Message-ID | <nq0v5u$7j4$1@solani.org> (permalink) |
| References | <2a5cf91a-151b-4379-9510-5dcd5a5bb196@googlegroups.com> |
| Mime-Version | 1.0 |
| Content-Type | text/plain; charset=utf-8 |
| Content-Transfer-Encoding | 7bit |
| X-Trace | solani.org 1472462846 7780 eJwFwQkBACAIA8BKyCfGweH6R/AuLFdie0Z6MFhnSt80W2rkEvMgPYUD6D3irgvG3Ow0bXxCZRJI (29 Aug 2016 09:27:26 GMT) |
| X-Complaints-To | abuse@news.solani.org |
| NNTP-Posting-Date | Mon, 29 Aug 2016 09:27:26 +0000 (UTC) |
| User-Agent | Mozilla/5.0 (Windows NT 10.0; WOW64; rv:45.0) Gecko/20100101 Thunderbird/45.2.0 |
| X-User-ID | eJwNwokRACEIBLCWDuTZLUcR+i/Bm8RXSFRaeJjPjwldvSn4pCAdGO9S0nVTz7WUk5hbBuP0AwfoEMc= |
| In-Reply-To | <2a5cf91a-151b-4379-9510-5dcd5a5bb196@googlegroups.com> |
| Cancel-Lock | sha1:emZZ1uT4P9S/c1PUigWqAvvGGUw= |
| X-NNTP-Posting-Host | eJwFwYERwEAIArCVCirOw+m7/whNKgRNp0pZV3cWQBoZy9TbGLrD/b0WHpHbXKfH0Vf6ARLAEOQ= |
| Xref | csiph.com comp.lang.javascript:31204 |
Show key headers only | View raw
On 29.08.2016 at 07:58, bit-naughty@hotmail.com wrote: > If I have a "forum" type of site, where stuff is being posted, and stored in the backend (in a MySQL database, using PHP), say,....can anyone type in Javascript into the post to accomplish naughty things? What's the most nefarious thing anyone can do? All I can think of is that someone would deface the page somehow, that *that* post is on, which, really, I can't see the point of..... Anything else? > ...and how do I protect against it? (the post will probably be displayed inside a DIV on the page, I think....) I suggest you read about Cross-Site-Scripting (XSS), for a start. -- Christoph M. Becker
Back to comp.lang.javascript | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread
Javascript injection bit-naughty@hotmail.com - 2016-08-28 22:58 -0700
Re: Javascript injection "Christoph M. Becker" <cmbecker69@arcor.de> - 2016-08-29 11:27 +0200
Re: Javascript injection Hans-Georg Michna <hans-georgNoEmailPlease@michna.com> - 2016-08-29 15:58 +0200
Re: Javascript injection "Evertjan." <exxjxw.hannivoort@inter.nl.net> - 2016-08-29 17:10 +0200
Re: Javascript injection Aleksandro <aleksandro@gmx.com> - 2016-08-30 16:35 -0300
Re: Javascript injection "Evertjan." <exxjxw.hannivoort@inter.nl.net> - 2016-08-31 10:25 +0200
Re: Javascript injection "Christoph M. Becker" <cmbecker69@arcor.de> - 2016-08-31 12:43 +0200
csiph-web