{"id":1008,"date":"2020-05-25T13:18:00","date_gmt":"2020-05-25T13:18:00","guid":{"rendered":"https:\/\/sectigostore.com\/blog\/?p=1008"},"modified":"2022-05-05T12:58:14","modified_gmt":"2022-05-05T12:58:14","slug":"what-is-cross-site-scripting-how-to-prevent-cross-site-scripting-attacks","status":"publish","type":"post","link":"https:\/\/sectigostore.com\/blog\/what-is-cross-site-scripting-how-to-prevent-cross-site-scripting-attacks\/","title":{"rendered":"What Is Cross Site Scripting and How to Prevent Cross Site Scripting Attacks"},"content":{"rendered":"\n<h2 class=\"wp-block-heading\"><strong><strong>According to a report by TrustWave, cross-site scripting accounts for 40% of web application attacks<\/strong><\/strong><\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Yes, technology is amazing. But not everything is hunky-dory in the digital space, which, if you\u2019re reading this article, you probably already know. If you have questions like \u201cwhat is cross site scripting?\u201d or wonder how to prevent cross site scripting attacks, you\u2019re most likely aware that surfing the internet is, by no means, without its risks (think <a href=\"https:\/\/www.kaspersky.com\/resource-center\/definitions\/drive-by-download\" target=\"_blank\" rel=\"noreferrer noopener\">drive-by download attacks<\/a>). But armed with knowledge and a few tools, we can steer clear of the carefully laid traps that cybercriminals set.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">This article is a step forward towards that common purpose as we discuss one of the most prevalent vulnerabilities seen in web applications today: cross site scripting attacks.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\"><strong>XSS Attacks: What Is Cross Site Scripting?<\/strong><\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Cross-site scripting (XSS) is a code injection technique and can either be a client-side or server-side vulnerability. XSS has continued to appear in the <a href=\"https:\/\/owasp.org\/www-project-top-ten\/\" target=\"_blank\" rel=\"noreferrer noopener\">OWASP top vulnerabilities<\/a> lists over the years. Though it has moved down the list, that&#8217;s not necessarily because the risks have lessened but possibly due to other risks becoming more severe. But what exactly is cross site scripting and why is it such a big deal?<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">In general, for an XSS attack to occur, three actors \u2014 an attacker, a victim, and a vulnerable web application \u2014 are engaged. The goal is to exploit the trust that the victim has in the website or application by manipulating the interactions between them. In an XSS attack, a threat actor:<\/p>\n\n\n\n<ul class=\"wp-block-list\"><li>Uses the application to deliver the payload,<\/li><li>Tricks the victim\u2019s browser to execute some malicious script (usually JavaScript), and then<\/li><li>Attempts to steal the user\u2019s sensitive information.<\/li><\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">Now that we\u2019ve some idea with respect to what is cross site scripting, let\u2019s take a look at how it works a little more in depth and explore the various types of XSS before we dive into how to prevent cross site scripting.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\"><strong>How Cross Site Scripting Works<\/strong><\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">An XSS attack involves a vulnerable application executing an unsanitized user input (malicious JavaScript injected by an attacker) while generating an output in terms of loading a resource or page as requested by an unsuspecting victim. Let\u2019s take a look at the example below that depicts how a query parameter can be manipulated to execute a script:<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Suppose your local library has a website where you can search its records to check if the book you want to read is available or is in circulation. You hop over to the site, type your search query, and on submitting the request, the generated URL may look something like shown below:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>https:&#47;&#47;mylibrary.com\/search?query=HarryPotter<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">What happens in the background is that the library\u2019s backend database is queried to see if the book you\u2019re looking for is in their records. If it is, their system checks its availability status before rendering the results page. However, if a malicious query is submitted for processing instead of a legitimate one in a vulnerable web app, the script will execute in the user\u2019s browser, as shown below:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>https:\/\/mylibrary.com\/search?query=&lt;script&gt;alert(\u201cThis could have been malicious!\u201d)&lt;\/script&gt;<\/code><\/pre>\n\n\n\n<div class=\"wp-block-image\"><figure class=\"aligncenter size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"363\" height=\"255\" src=\"https:\/\/sectigostore.com\/blog\/wp-content\/uploads\/2020\/05\/warning-message-malicious.png\" alt=\"Graphic of a warning message\" class=\"wp-image-1011 addshadow\" srcset=\"https:\/\/sectigostore.com\/blog\/wp-content\/uploads\/2020\/05\/warning-message-malicious.png 363w, https:\/\/sectigostore.com\/blog\/wp-content\/uploads\/2020\/05\/warning-message-malicious-300x211.png 300w\" sizes=\"auto, (max-width: 363px) 100vw, 363px\" \/><\/figure><\/div>\n\n\n\n<p class=\"wp-block-paragraph\">Though the resultant page is generated based on your search query, ideally, no part of the user input should be used in rendering the page without first properly stripping it of any malicious markup. The way to do that is by treating all user input as untrusted data and using proper encoding or output escaping techniques.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\"><strong>Types of Cross Site Scripting Attacks (XSS Attacks)<\/strong><\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">According to OWASP, XSS attacks are <a href=\"https:\/\/owasp.org\/www-community\/Types_of_Cross-Site_Scripting\" target=\"_blank\" rel=\"noreferrer noopener\">categorized into three types<\/a> \u2014 namely reflected, stored, and DOM based. Ultimately, the goal of these attacks is to steal users\u2019 sensitive information and perform sensitive operations by exploiting the vulnerabilities that exist within vulnerable web applications.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Let\u2019s explore each of these categories a little more in depth:<\/p>\n\n\n\n<h3 class=\"wp-block-heading\"><strong>Reflected XSS<\/strong><\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">With a <a href=\"https:\/\/portswigger.net\/web-security\/cross-site-scripting\/reflected\" target=\"_blank\" rel=\"noreferrer noopener\">reflected XSS<\/a> (also called non-persistent XSS) attack, an attacker tricks the victim into making a request that they can control. The threat actor places malicious links on websites they control or entices the victim to click on a link that\u2019s delivered via email, SMS message, or through social platforms.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Ultimately, if you take a look at current <a href=\"https:\/\/sectigostore.com\/blog\/phishing-statistics-phishing-stats-to-help-avoid-getting-reeled-in\/\" target=\"_blank\" rel=\"noreferrer noopener\">phishing statistics<\/a>, you\u2019ll probably agree that getting unsuspecting users to click on unknown links isn\u2019t one of the most difficult things to do in the world. Once the attacker gains control, they\u2019ll be able to steal cookies, account information, or impersonate legitimate users to carry out operations with the application being none the wiser.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Although it\u2019s considered less dangerous than stored XSS, reflected XSS is more common. What makes it an even greater threat is that potentially any page that accepts a user-modifiable parameter through a GET or a POST request and displays the parameter back to them can be exploited to construct a malicious URL.<\/p>\n\n\n\n<div class=\"wp-block-image\"><figure class=\"aligncenter size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"480\" src=\"https:\/\/sectigostore.com\/blog\/wp-content\/uploads\/2020\/05\/reflected-xss-attack-1024x480.png\" alt=\"Graphic illustrating a reflected cross site scripting attack\" class=\"wp-image-1010 addshadow\" srcset=\"https:\/\/sectigostore.com\/blog\/wp-content\/uploads\/2020\/05\/reflected-xss-attack-1024x480.png 1024w, https:\/\/sectigostore.com\/blog\/wp-content\/uploads\/2020\/05\/reflected-xss-attack-300x141.png 300w, https:\/\/sectigostore.com\/blog\/wp-content\/uploads\/2020\/05\/reflected-xss-attack-560x262.png 560w, https:\/\/sectigostore.com\/blog\/wp-content\/uploads\/2020\/05\/reflected-xss-attack-1536x720.png 1536w, https:\/\/sectigostore.com\/blog\/wp-content\/uploads\/2020\/05\/reflected-xss-attack-940x441.png 940w, https:\/\/sectigostore.com\/blog\/wp-content\/uploads\/2020\/05\/reflected-xss-attack.png 1598w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure><\/div>\n\n\n\n<h3 class=\"wp-block-heading\"><strong>Stored XSS<\/strong><\/h3>\n\n\n\n<p class=\"wp-block-paragraph\"><a href=\"https:\/\/portswigger.net\/web-security\/cross-site-scripting\/stored\" target=\"_blank\" rel=\"noreferrer noopener\">Stored XSS<\/a> (also known as a second-order or persistent XSS attack) arises when an attacker injects a malicious script directly into a vulnerable web application. The data submitted to the application can come from various sources like comments, posts pulled from social media platforms, etc.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">For example, the figure below depicts how a message board in a website that allows HTML tags to be embedded can be leveraged to store malicious scripts. The script is executed as a part of the application for any visitor that accesses the site.<\/p>\n\n\n\n<div class=\"wp-block-image\"><figure class=\"aligncenter size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"345\" src=\"https:\/\/sectigostore.com\/blog\/wp-content\/uploads\/2020\/05\/stored-xss-attack-1024x345.png\" alt=\"Graphic illustrating a stored cross site scripting attack\" class=\"wp-image-1009 addshadow\" srcset=\"https:\/\/sectigostore.com\/blog\/wp-content\/uploads\/2020\/05\/stored-xss-attack-1024x345.png 1024w, https:\/\/sectigostore.com\/blog\/wp-content\/uploads\/2020\/05\/stored-xss-attack-300x101.png 300w, https:\/\/sectigostore.com\/blog\/wp-content\/uploads\/2020\/05\/stored-xss-attack-560x189.png 560w, https:\/\/sectigostore.com\/blog\/wp-content\/uploads\/2020\/05\/stored-xss-attack-1536x518.png 1536w, https:\/\/sectigostore.com\/blog\/wp-content\/uploads\/2020\/05\/stored-xss-attack-940x317.png 940w, https:\/\/sectigostore.com\/blog\/wp-content\/uploads\/2020\/05\/stored-xss-attack.png 1610w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure><\/div>\n\n\n\n<h3 class=\"wp-block-heading\"><strong>DOM Based XSS<\/strong><\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Document object model is a language-independent convention that uses a tree structure to describe and work with objects in an XML or HTML document. <\/p>\n\n\n\n<p class=\"wp-block-paragraph\">With this in mind, a <a rel=\"noreferrer noopener\" href=\"https:\/\/portswigger.net\/web-security\/cross-site-scripting\/dom-based\" target=\"_blank\">DOM based XSS attack<\/a> is an exploitation of a client-side vulnerability since the untrusted data source is generated in the client by injecting malicious code into the native JavaScript. A DOM XSS attack occurs if an attacker manipulates DOM objects such as document.url, document.location, document.referrer, etc. so as to include XSS content on the page.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Let\u2019s take a look at the following example to get a clearer picture of how DOM XSS works.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Suppose a dashboard for viewing sales projection can be rendered in different languages based on user preference, and the default language is set as English. The page can be accessed via the URL below<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>http:&#47;&#47;www.example.com\/page.html?default=English<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">An attacker can craft a malicious URL and share it with the victim:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>http:&#47;&#47;www.example.com\/page.html#default=&lt;script&gt;alert(document.cookie)&lt;\/script&gt;<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">The server doesn\u2019t receive the part in the URL after the \u201c#,\u201d which is why DOM XSS may not appear in server logs. The client browser sends an HTTP request to example.com and loads the static HTML page. It uses the malicious link while building the DOM to populate the document.url property. When the browser parses the page, all of the content from the document.url object is extracted, and the script is executed.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">At this point, you should have a fair understanding of how to answer the question \u201cwhat is cross site scripting\u201d and recognize how dangerous it can be if your application is vulnerable to this attack. As such, it\u2019s critical that we identify and remediate these threats. Let\u2019s look at how to prevent cross site scripting and steps we can take to safeguard our applications against any security breach via XSS vulnerability.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\"><strong>How to Prevent Cross Site Scripting<\/strong><\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">How you go about <a rel=\"noreferrer noopener\" href=\"https:\/\/cheatsheetseries.owasp.org\/cheatsheets\/Cross_Site_Scripting_Prevention_Cheat_Sheet.html\" target=\"_blank\">remediating XSS<\/a> vulnerabilities depends on a few factors:<\/p>\n\n\n\n<ul class=\"wp-block-list\"><li>Where the vulnerabilities arise,<\/li><li>The complexity of the application, and<\/li><li>The manner in which the web app handles dynamic content or user-controllable data.<\/li><\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">When we talk about how to prevent cross site scripting, we can adopt a combination of the following countermeasures to keep XSS vulnerabilities from arising in our application:<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Input Validation<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">The entry points to the application, where user input is accepted, should use input filters on the data based on expected values that fall within the constraints you define (with reasonable restrictions on the permitted set of characters).<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">For instance, if a new user is filling in the user registration form and there are fields like name, age, country, city, etc., apply validation checks to see if the data accepted should be an integer, can be alphanumeric, and so on. To do this, PHP developers can use filter_var(), a built-in filter or functions like is_numeric(), preg_match(), etc. Different languages have different functions that can be utilized to sanitize user-supplied data.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Additionally, use dropdown lists, calendars, etc. where feasible instead of manually typing in values.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Output Validation<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Depending on the output context, wherever there\u2019s a possibility that input strings from users might get reflected in the output responses, encode them to prevent them from being interpreted as active content. The usage of encoding techniques like URLEncode, HTMLEncode, etc. and output escaping reduces the risk of executing a malicious script. Furthermore, disallow manipulating encoding types and explicitly specify appropriate headers and character sets in response headers. For example:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Content-Type: text\/html; charset=ISO-8859-1<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\">Discarding Unsafe Script Insertion Points<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Inserting user-supplied data into existing script code that allows attackers to take control of the context of the data they can manipulate is extremely dangerous and acts as a springboard for malicious actions.&nbsp;<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">For applications (like blogs) where users need to be allowed to use HTML tags for formatting, whitelisting may be deemed a safe option if allowing a limited subset of HTML tags. However, the application\u2019s trust can still be abused. Instead, consider using an intermediate markup language that the application converts into corresponding HTML markup.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Other mitigation strategies include:<\/p>\n\n\n\n<ul class=\"wp-block-list\"><li>Cookie security (using HTTPOnly flag),<\/li><li>Using content security policy (CSP) to prevent XSS,<\/li><li>Employing appropriate modern frameworks, and<\/li><li>Applying the X-XSS-Protection Response Header.<\/li><\/ul>\n\n\n\n<h2 class=\"wp-block-heading\"><strong>In Summary<\/strong><\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">A 2018 <a href=\"https:\/\/www2.trustwave.com\/rs\/815-RFM-693\/images\/Trustwave_2018-GSR_20180329_Interactive.pdf\" target=\"_blank\" rel=\"noreferrer noopener\">report from TrustWave<\/a> indicates that out of the most critical vulnerabilities, the largest shares of high-risk vulnerabilities consisted of applications that were susceptible to XSS. Although we haven\u2019t discussed the specific techniques behind how these attacks are performed (we don\u2019t want to help budding black hat hackers, after all!), hopefully, your question \u201cwhat is cross site scripting?\u201d has been answered. We\u2019ve also briefly spoken about its various types and tried to address how to prevent cross site scripting.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">An XSS alone or in combination with other security bugs like cross site request forgery (CSRF) can be used to steal users\u2019 sensitive information (such as usernames, passwords, etc.), to remotely control or monitor the victim\u2019s browser, or conduct other nefarious activities. It is, therefore, in your best interest (and those of your customers or users) to conduct regular vulnerability scans and perform manual penetration tests to identify and remediate these risks as early as possible.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>According to a report by TrustWave, cross-site scripting accounts for 40% of web application attacks Yes, technology is amazing. But not everything is hunky-dory in the digital space, which, if&#8230;<\/p>\n","protected":false},"author":9,"featured_media":1012,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"inline_featured_image":false,"footnotes":"","tve_updated_post":"","tve_custom_css":"","tve_user_custom_css":"","tve_globals":{},"tcb2_ready":0,"tcb_editor_enabled":0,"tve_landing_page":"","_tve_header":"","_tve_footer":""},"categories":[13],"tags":[72,73,38],"class_list":["post-1008","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-cyber-security","tag-cross-site-scripting","tag-injection-attacks","tag-web-application-security","post-with-tags"],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v28.8 - https:\/\/yoast.com\/product\/yoast-seo-wordpress\/ -->\n<title>What Is Cross Site Scripting and How to Prevent Cross Site Scripting Attacks - InfoSec Insights<\/title>\n<meta name=\"description\" content=\"Wondering &quot;what is cross site scripting?&quot; This type of web app attack is a true menace. We&#039;ll cover what they are &amp; how to prevent cross scripting attacks.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/sectigostore.com\/blog\/what-is-cross-site-scripting-how-to-prevent-cross-site-scripting-attacks\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"What Is Cross Site Scripting and How to Prevent Cross Site Scripting Attacks - InfoSec Insights\" \/>\n<meta property=\"og:description\" content=\"Wondering &quot;what is cross site scripting?&quot; This type of web app attack is a true menace. We&#039;ll cover what they are &amp; how to prevent cross scripting attacks.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/sectigostore.com\/blog\/what-is-cross-site-scripting-how-to-prevent-cross-site-scripting-attacks\/\" \/>\n<meta property=\"og:site_name\" content=\"InfoSec Insights\" \/>\n<meta property=\"article:published_time\" content=\"2020-05-25T13:18:00+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2022-05-05T12:58:14+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/sectigostore.com\/blog\/wp-content\/uploads\/2020\/05\/cross-site-scripting-attack.jpg\" \/>\n\t<meta property=\"og:image:width\" content=\"1600\" \/>\n\t<meta property=\"og:image:height\" content=\"1000\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" \/>\n<meta name=\"author\" content=\"Lumena Mukherjee\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Lumena Mukherjee\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"9 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/sectigostore.com\\\/blog\\\/what-is-cross-site-scripting-how-to-prevent-cross-site-scripting-attacks\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/sectigostore.com\\\/blog\\\/what-is-cross-site-scripting-how-to-prevent-cross-site-scripting-attacks\\\/\"},\"author\":{\"name\":\"Lumena Mukherjee\",\"@id\":\"https:\\\/\\\/sectigostore.com\\\/blog\\\/#\\\/schema\\\/person\\\/8fc401352fbdfcfdf08996099c088b1f\"},\"headline\":\"What Is Cross Site Scripting and How to Prevent Cross Site Scripting Attacks\",\"datePublished\":\"2020-05-25T13:18:00+00:00\",\"dateModified\":\"2022-05-05T12:58:14+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/sectigostore.com\\\/blog\\\/what-is-cross-site-scripting-how-to-prevent-cross-site-scripting-attacks\\\/\"},\"wordCount\":1766,\"commentCount\":0,\"image\":{\"@id\":\"https:\\\/\\\/sectigostore.com\\\/blog\\\/what-is-cross-site-scripting-how-to-prevent-cross-site-scripting-attacks\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/sectigostore.com\\\/blog\\\/wp-content\\\/uploads\\\/2020\\\/05\\\/cross-site-scripting-attack.jpg\",\"keywords\":[\"cross site scripting\",\"injection attacks\",\"web application security\"],\"articleSection\":[\"Cyber Security\"],\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\\\/\\\/sectigostore.com\\\/blog\\\/what-is-cross-site-scripting-how-to-prevent-cross-site-scripting-attacks\\\/#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/sectigostore.com\\\/blog\\\/what-is-cross-site-scripting-how-to-prevent-cross-site-scripting-attacks\\\/\",\"url\":\"https:\\\/\\\/sectigostore.com\\\/blog\\\/what-is-cross-site-scripting-how-to-prevent-cross-site-scripting-attacks\\\/\",\"name\":\"What Is Cross Site Scripting and How to Prevent Cross Site Scripting Attacks - InfoSec Insights\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/sectigostore.com\\\/blog\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/sectigostore.com\\\/blog\\\/what-is-cross-site-scripting-how-to-prevent-cross-site-scripting-attacks\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/sectigostore.com\\\/blog\\\/what-is-cross-site-scripting-how-to-prevent-cross-site-scripting-attacks\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/sectigostore.com\\\/blog\\\/wp-content\\\/uploads\\\/2020\\\/05\\\/cross-site-scripting-attack.jpg\",\"datePublished\":\"2020-05-25T13:18:00+00:00\",\"dateModified\":\"2022-05-05T12:58:14+00:00\",\"author\":{\"@id\":\"https:\\\/\\\/sectigostore.com\\\/blog\\\/#\\\/schema\\\/person\\\/8fc401352fbdfcfdf08996099c088b1f\"},\"description\":\"Wondering \\\"what is cross site scripting?\\\" This type of web app attack is a true menace. We'll cover what they are & how to prevent cross scripting attacks.\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/sectigostore.com\\\/blog\\\/what-is-cross-site-scripting-how-to-prevent-cross-site-scripting-attacks\\\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/sectigostore.com\\\/blog\\\/what-is-cross-site-scripting-how-to-prevent-cross-site-scripting-attacks\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/sectigostore.com\\\/blog\\\/what-is-cross-site-scripting-how-to-prevent-cross-site-scripting-attacks\\\/#primaryimage\",\"url\":\"https:\\\/\\\/sectigostore.com\\\/blog\\\/wp-content\\\/uploads\\\/2020\\\/05\\\/cross-site-scripting-attack.jpg\",\"contentUrl\":\"https:\\\/\\\/sectigostore.com\\\/blog\\\/wp-content\\\/uploads\\\/2020\\\/05\\\/cross-site-scripting-attack.jpg\",\"width\":1600,\"height\":1000,\"caption\":\"Server and code graphic for what is cross site scripting article\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/sectigostore.com\\\/blog\\\/what-is-cross-site-scripting-how-to-prevent-cross-site-scripting-attacks\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/sectigostore.com\\\/blog\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"What Is Cross Site Scripting and How to Prevent Cross Site Scripting Attacks\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/sectigostore.com\\\/blog\\\/#website\",\"url\":\"https:\\\/\\\/sectigostore.com\\\/blog\\\/\",\"name\":\"InfoSec Insights\",\"description\":\"SectigoStore.com Blog\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/sectigostore.com\\\/blog\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/sectigostore.com\\\/blog\\\/#\\\/schema\\\/person\\\/8fc401352fbdfcfdf08996099c088b1f\",\"name\":\"Lumena Mukherjee\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/8a52ef8468ca2c6184cc71ebfa0bcdbf4c16ab01d988415c1bc743cb16730db3?s=96&d=mm&r=g\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/8a52ef8468ca2c6184cc71ebfa0bcdbf4c16ab01d988415c1bc743cb16730db3?s=96&d=mm&r=g\",\"contentUrl\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/8a52ef8468ca2c6184cc71ebfa0bcdbf4c16ab01d988415c1bc743cb16730db3?s=96&d=mm&r=g\",\"caption\":\"Lumena Mukherjee\"},\"description\":\"Lumena is a cybersecurity consultant, tech writer, and regular columnist for InfoSec Insights. She is currently pursuing her masters in cybersecurity and has a passion for helping companies implement better security programs to protect their customers' data.\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"What Is Cross Site Scripting and How to Prevent Cross Site Scripting Attacks - InfoSec Insights","description":"Wondering \"what is cross site scripting?\" This type of web app attack is a true menace. We'll cover what they are & how to prevent cross scripting attacks.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/sectigostore.com\/blog\/what-is-cross-site-scripting-how-to-prevent-cross-site-scripting-attacks\/","og_locale":"en_US","og_type":"article","og_title":"What Is Cross Site Scripting and How to Prevent Cross Site Scripting Attacks - InfoSec Insights","og_description":"Wondering \"what is cross site scripting?\" This type of web app attack is a true menace. We'll cover what they are & how to prevent cross scripting attacks.","og_url":"https:\/\/sectigostore.com\/blog\/what-is-cross-site-scripting-how-to-prevent-cross-site-scripting-attacks\/","og_site_name":"InfoSec Insights","article_published_time":"2020-05-25T13:18:00+00:00","article_modified_time":"2022-05-05T12:58:14+00:00","og_image":[{"width":1600,"height":1000,"url":"https:\/\/sectigostore.com\/blog\/wp-content\/uploads\/2020\/05\/cross-site-scripting-attack.jpg","type":"image\/jpeg"}],"author":"Lumena Mukherjee","twitter_card":"summary_large_image","twitter_misc":{"Written by":"Lumena Mukherjee","Est. reading time":"9 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/sectigostore.com\/blog\/what-is-cross-site-scripting-how-to-prevent-cross-site-scripting-attacks\/#article","isPartOf":{"@id":"https:\/\/sectigostore.com\/blog\/what-is-cross-site-scripting-how-to-prevent-cross-site-scripting-attacks\/"},"author":{"name":"Lumena Mukherjee","@id":"https:\/\/sectigostore.com\/blog\/#\/schema\/person\/8fc401352fbdfcfdf08996099c088b1f"},"headline":"What Is Cross Site Scripting and How to Prevent Cross Site Scripting Attacks","datePublished":"2020-05-25T13:18:00+00:00","dateModified":"2022-05-05T12:58:14+00:00","mainEntityOfPage":{"@id":"https:\/\/sectigostore.com\/blog\/what-is-cross-site-scripting-how-to-prevent-cross-site-scripting-attacks\/"},"wordCount":1766,"commentCount":0,"image":{"@id":"https:\/\/sectigostore.com\/blog\/what-is-cross-site-scripting-how-to-prevent-cross-site-scripting-attacks\/#primaryimage"},"thumbnailUrl":"https:\/\/sectigostore.com\/blog\/wp-content\/uploads\/2020\/05\/cross-site-scripting-attack.jpg","keywords":["cross site scripting","injection attacks","web application security"],"articleSection":["Cyber Security"],"inLanguage":"en-US","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/sectigostore.com\/blog\/what-is-cross-site-scripting-how-to-prevent-cross-site-scripting-attacks\/#respond"]}]},{"@type":"WebPage","@id":"https:\/\/sectigostore.com\/blog\/what-is-cross-site-scripting-how-to-prevent-cross-site-scripting-attacks\/","url":"https:\/\/sectigostore.com\/blog\/what-is-cross-site-scripting-how-to-prevent-cross-site-scripting-attacks\/","name":"What Is Cross Site Scripting and How to Prevent Cross Site Scripting Attacks - InfoSec Insights","isPartOf":{"@id":"https:\/\/sectigostore.com\/blog\/#website"},"primaryImageOfPage":{"@id":"https:\/\/sectigostore.com\/blog\/what-is-cross-site-scripting-how-to-prevent-cross-site-scripting-attacks\/#primaryimage"},"image":{"@id":"https:\/\/sectigostore.com\/blog\/what-is-cross-site-scripting-how-to-prevent-cross-site-scripting-attacks\/#primaryimage"},"thumbnailUrl":"https:\/\/sectigostore.com\/blog\/wp-content\/uploads\/2020\/05\/cross-site-scripting-attack.jpg","datePublished":"2020-05-25T13:18:00+00:00","dateModified":"2022-05-05T12:58:14+00:00","author":{"@id":"https:\/\/sectigostore.com\/blog\/#\/schema\/person\/8fc401352fbdfcfdf08996099c088b1f"},"description":"Wondering \"what is cross site scripting?\" This type of web app attack is a true menace. We'll cover what they are & how to prevent cross scripting attacks.","breadcrumb":{"@id":"https:\/\/sectigostore.com\/blog\/what-is-cross-site-scripting-how-to-prevent-cross-site-scripting-attacks\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/sectigostore.com\/blog\/what-is-cross-site-scripting-how-to-prevent-cross-site-scripting-attacks\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/sectigostore.com\/blog\/what-is-cross-site-scripting-how-to-prevent-cross-site-scripting-attacks\/#primaryimage","url":"https:\/\/sectigostore.com\/blog\/wp-content\/uploads\/2020\/05\/cross-site-scripting-attack.jpg","contentUrl":"https:\/\/sectigostore.com\/blog\/wp-content\/uploads\/2020\/05\/cross-site-scripting-attack.jpg","width":1600,"height":1000,"caption":"Server and code graphic for what is cross site scripting article"},{"@type":"BreadcrumbList","@id":"https:\/\/sectigostore.com\/blog\/what-is-cross-site-scripting-how-to-prevent-cross-site-scripting-attacks\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/sectigostore.com\/blog\/"},{"@type":"ListItem","position":2,"name":"What Is Cross Site Scripting and How to Prevent Cross Site Scripting Attacks"}]},{"@type":"WebSite","@id":"https:\/\/sectigostore.com\/blog\/#website","url":"https:\/\/sectigostore.com\/blog\/","name":"InfoSec Insights","description":"SectigoStore.com Blog","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/sectigostore.com\/blog\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Person","@id":"https:\/\/sectigostore.com\/blog\/#\/schema\/person\/8fc401352fbdfcfdf08996099c088b1f","name":"Lumena Mukherjee","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/secure.gravatar.com\/avatar\/8a52ef8468ca2c6184cc71ebfa0bcdbf4c16ab01d988415c1bc743cb16730db3?s=96&d=mm&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/8a52ef8468ca2c6184cc71ebfa0bcdbf4c16ab01d988415c1bc743cb16730db3?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/8a52ef8468ca2c6184cc71ebfa0bcdbf4c16ab01d988415c1bc743cb16730db3?s=96&d=mm&r=g","caption":"Lumena Mukherjee"},"description":"Lumena is a cybersecurity consultant, tech writer, and regular columnist for InfoSec Insights. She is currently pursuing her masters in cybersecurity and has a passion for helping companies implement better security programs to protect their customers' data."}]}},"_links":{"self":[{"href":"https:\/\/sectigostore.com\/blog\/wp-json\/wp\/v2\/posts\/1008","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/sectigostore.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/sectigostore.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/sectigostore.com\/blog\/wp-json\/wp\/v2\/users\/9"}],"replies":[{"embeddable":true,"href":"https:\/\/sectigostore.com\/blog\/wp-json\/wp\/v2\/comments?post=1008"}],"version-history":[{"count":0,"href":"https:\/\/sectigostore.com\/blog\/wp-json\/wp\/v2\/posts\/1008\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/sectigostore.com\/blog\/wp-json\/wp\/v2\/media\/1012"}],"wp:attachment":[{"href":"https:\/\/sectigostore.com\/blog\/wp-json\/wp\/v2\/media?parent=1008"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/sectigostore.com\/blog\/wp-json\/wp\/v2\/categories?post=1008"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/sectigostore.com\/blog\/wp-json\/wp\/v2\/tags?post=1008"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}