Cross-Site Scripting - cross site scripting examples

Cross Site Scripting, OR XSS, is a way for hackers to gather your website’s user data by using malicious markup or JavaScript code to trick a user, or their browser, to follow a bad link or present their login details to a fake login screen that instead of logging them in, steals their personal information. The best way to defend against XSS is following...

Strip html tags like h1, <script>, for this use php strip_tags function

escape the data before showing on website, for this use htmlentities function.


An Example:
A basic example of XSS is when a malicious user injects a script in a legitimate shopping site URL which in turn redirects a user to a fake but identical page. The malicious page would run a script to capture the cookie of the user browsing the shopping site, and that cookie gets sent to the malicious user who can now hijack the legitimate user’s session. Although no real hack has been performed against the shopping site, XSS has still exploited a scripting weakness in the page to snare a user and take command of his session. A trick which often is used to make malicious URLs less obvious is to have the XSS part of the URL encoded in HEX (or other encoding methods). This will look harmless to the user who recognizes the URL he is familiar with, and simply disregards and following ‘tricked’ code which would be encoded and therefore inconspicuous.

Best Related Posts are Following:

1. How can I prevent SQL-injection in PHP?.
2. What is Best method for sanitizing user input with PHP?.
3. How can I prevent SQL-injection in PHP [SOLVED].
4. PHP Register Globals.
5. PHP - Secure Ajax Call from Hackers - Example.
6. htaccess code snippets example.
7. Manage Cron Job with PHP - SSH2 Connection.
8. Shared Server Security Risk open_basedir disable_functions disable_classes.
9. Spoofed Forms - Stop Spoofed Form Submissions.
10. Session Fixation.
11. Session Hijacking.
12. openssl private encrypt.
13. Cross Site Request Forgery.
14. SQL Injection Attack - PHP & MySQL.
15. Cross-Site Scripting.
16. PHP INI settings.

PHP INI settings

open_basedir, disable_classess, disable_functions and safe_mode are the directive used to improve the security while on shared hosting environment.

• When you are using shared server always set open_basedir to your root directory in php.ini. 
• This directive allows you to disable certain classes for security reasons. It takes on a comma-delimited list of class names. disable_classes is not affected by Safe Mode. This directive must be set in php.ini 
• This directive allows you to disable certain functions for security reasons. It takes on a comma-delimited list of function names. disable_ functions is not affected by Safe Mode. This directive must be set in php.ini. 
• safe_mode should be off. 
• display_errors should be off, so that end user can see guess the code, when error come in website 
• log_errors should be on, so that you can check, if some one try to access your site or any page to whom not authorization. 
• allow_url_fopen include should be off. allow_url_fopen enables the URL-aware fopen wrappers that enable accessing the files from remote server. allow_url_include allows the use of URL-aware fopen wrappers with the following functions: include, include_once, require, require_once (remote add files). 
• magic quotes (magic_quotes_gpc, magic_quotes_runtime) should be off. It will avoid to add the extra slahes (avoid to call addslashes function). 
• register_globals must be off. Take for example this URL, http://yoursite.com/index.php?var=1, which includes a query string. The register_globals statement allows us to access the value with $var instead of $_GET['var'] automatically. 
• system(), passthru() and exec() functions must be disable all of which allow a string to be run as a command on the operating system shell.

Best Related Posts are Following:

1. How can I prevent SQL-injection in PHP?.
2. What is Best method for sanitizing user input with PHP?.
3. Difference between Notice and warning and fatal error.
4. How can I prevent SQL-injection in PHP [SOLVED].
5. PHP Register Globals.
6. PHP Sessions and Cookie and Security.
7. Free Boost Web Application By 20% in Simple Steps.
8. PHP Check Mime Type of File - Return Information About A File.
9. Crontab Interview Questions and Answers.
10. Improve Ajax Performance.
11. PHP Captcha Code Example Code Snippets.
12. PHP - Secure Ajax Call from Hackers - Example.
13. htaccess code snippets example.
14. Manage Cron Job with PHP - SSH2 Connection.
15. Shared Server Security Risk open_basedir disable_functions disable_classes.
16. Spoofed Forms - Stop Spoofed Form Submissions.
17. Session Fixation.
18. Session Hijacking.
19. openssl private encrypt.
20. Cross Site Request Forgery.
21. SQL Injection Attack - PHP & MySQL.
22. Cross-Site Scripting.