Question

Possible Duplicate:
What are the best practices for avoid xss attacks in a PHP site

For example:

http://www.mid-day.com/searchresult.php?query=%3Cscript%3Ealert%28%22This%20is%20vulnerable%20for%20XSS%20..%20by%20binny%22%29%3C/script%3E

This website has an XSS DOM based vulnerability I want to know what causes this vulnerability and how to prevent it?

Answer 1

You should always HTML encode values that come from the user like querystring parameters before outputting them. You could use the htmlentities function.

Instead of:

$str = $_GET['a'];
echo $str;

use:

$str = $_GET['a'];
echo htmlentities($str);