Question

I got the below error when I testing my mobile application. How can i resolve this XSS error?

The value of the q request parameter is copied into the HTML document as plain text between tags. The payload 2906f<script>alert(1)</script>b08ffac3085 was submitted in the q parameter. This input was echoed unmodified in the application’s response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application’s response.

Answer 1

You encode it for HTML before you put it in the HTML document.

With JavaScript (since that is the only language you’ve mentioned), that generally means using createTextNode instead of innerHTML.