XSS Reference
XSS Attack Types
Stored XSS
Malicious script stored in database, affects all users who view the content.
Reflected XSS
Script in URL parameter, reflected in response without sanitization.
DOM-based XSS
Vulnerability in client-side JS that processes URL/DOM data unsafely.
Prevention Techniques
| Technique | Example |
|---|---|
| Output Encoding | htmlspecialchars($var, ENT_QUOTES) |
| CSP Header | Content-Security-Policy: default-src 'self' |
| Safe APIs | element.textContent = data // not innerHTML |
| Input Validation | Whitelist allowed characters/patterns |
| HttpOnly Cookie | Set-Cookie: session=...; HttpOnly; Secure |