How To Prevent The Most Common Cross Site Scripting Attack

Cross site scripting is one of the most common ways that a hacker will attempt to infiltrate a website. There are many different forms of cross site scripting, but the most common cause of cross site scripting is using the JavaScript method innerHTML with user input. Any form of user input must be escaped before being used with innerHTML, and any use of innerHTML should be thoroughly thought out to ensure no user input can make it through without being sanitized. It is such an easy mistake to make, but luckily the fix is also just as easy.

Cross Site Scripting Article:

CodePen For This Video:

Twitter:

GitHub:

CodePen:

#XSS #WebDevelopment #Programming

[FairyRat]

Great stuff. Hello from The Odin Project!

[akhilpadmanaban]

bro recently iw as just using a normal stranger chat page in google and a person did this like showing big running charectors and all....and he told he is doing html should i do???? should he have harmed me????say bro....suddenly my replies went also changed in that site..i then disconnected and me bro..how to check that im secure

[luizgustavoveneziani]

Explanation for people in a hurry. Clear, objective, and exemplified. You've got another subscriber.

[AmmarRai]

I don't know what's more amazing... that website.. or that hair...

[dimarak]

Good explanation. But if one does not put queries in the url then stuff like this doesnt matter, so one could still safely use innerHTML.
Generally the client is never safe, because all client code is accessible through dev tools in the browser.

So a strong backend protection and safe routing is all it takes to prevent stuff like this.

[poudlardo]

hi there, coming from the odin project

[emonymph]

Umm why didn't you show us how to fix the problem right at the end?? Kinda weird that you stopped on the most important part lol

[JosephKhalilov]

Simple and clear explanation! Thank you!

[leo]

This is genuinely terrifying...thank you for covering this topic and informing those of us who don't have that in depth knowledge about such security topics..

[hariprasath]

“><script>alert(“Channel Hacked!!!”)</script>

[codinginflow]

Thank you, the first 3 minutes perfectly summarized all my questions

[thecodersbay]

<img src onerror="alert('hi')">

[natarajanmuthuraman]

If you want to use innerHTML, then just encode it before putting inside innerHTML.

To encode, just replace '<' by '&lt;' and '>' by '&gt;'.

So when it goes in the innerHTML, the browser changes them back to '<' and '>'.

[leblanc]

Clear and concise explanation of how this can be dangerous. Ive been looking around for a while now because I couldn't understand the risk associated, but you did a great job doing it, thanks!

[anvayjain]

Odin project keeps sending me to this golden channel.

[viallymboma]

All those who dislike and hate this video are definitely hackers...thanks for the explanation Kyle

[morgengabe]

I've seen a bunch of people talk about xss before but you've got a real knack for explaining it simply. Would be great to see more security videos from you!

[danser_theplayer]

Discord had to patch this thing just a week ago, I mean cmon how has nobody considered it?

[travisblogstravis]

My pc just got hacked were I axadently put a script in my URL and some guy almost got my pc but I emailed my local police and they got him

[maciejleszek]

Problem is that also innerText is not a a safe method, textContent is a better idea