A Quick Look at Cross Site Scripting - What is Cross Site Scripting?


To understand what Cross Site Scripting is, let's see a usual situation, common to many sites.

Let's say we are taking some information passed in on a querystring (the string after the (?) character within a URL), with the purpose of displaying the content of a variable, for example, the visitor's name:


As we can see in this simple querystring, we are passing the visitor's name as a parameter in the URL, and then displaying it on our "welcomepage.php" page with the following PHP code:

echo ‘Welcome to our site ' . stripslashes($_GET[‘name']);

The result of this snippet is shown below:

Welcome to our site John

This is pretty simple and straightforward. We're displaying the content of the "name" variable, by using the $_GET superglobal PHP array, as we have done probably hundreds of times. Everything seems to be fine. Now, what's wrong with this code? Nothing really. But let's modify the querystring by replacing our visitor's name passed in the URL:


with something like this:

<script language=javascript>alert
(‘Hey, you are going to be hijacked!');</script>

Do you remember the PHP code included in our "welcome.php" page? Yes, you're correct. When we modify the querystring, the following code is executed:

echo ‘Welcome to our site ‘ .
<script language=javascript> alert(‘Hey, you are going
to be hijacked!');</script>

The output of this code is an alert JavaScript box telling you "Hey, you are going be hijacked!" after the "Welcome to our site" phrase.

Very ugly stuff, right? That's a simple example of the Cross Site Scripting vulnerability. This means that any pasted JavaScript code into the URL will be executed happily with no complaints at all.

attitude blog

My name is








Project Summary (details, timeline, budget, etc.)


Attach File (.doc, .docx, .pdf, .txt, .jpg only)