Hi,
In my application we have an input box, which accepts XML. Means User can copy and paste XML in that box.
few days back our QA team riase a bug that this Input box is not Cross Site Scripting safe. means if they pass any java script in XML tab then it also save that.
like : <Test>alert('hello');</Test>
our application save this value in database and on display page (where we show this data) show alert box.
- Server.htmlEncode is not fixing our prolem.
- I am not in favour to compare input against possible javascript syntax
Please suggest me how we can handle this scenario.
Go to the complete details ...