Question

This is my search function

$('#productSearch').live('focus',function(){
    $(this).stop().animate({'width':'200px'}, 600);
    var searchterm = encodeURIComponent($('#productSearch').val());
    if (searchterm != '') {
        $('.ajax-search-results').show();
        $('.ajax-search-results').load('<?php echo get_template_directory_uri(); ?>/ajax/search.php?type=product&s=' + searchterm);
    }
});

I just received alert that it contains XSS vulnerability, I am not sure how to fix it though, or where it resides.

Can anyone shed any light on this?

Answer 1

You can follow the following rules with the variable searcterm:

https://www.owasp.org/index.php/XSS_(Cross_Site_Scripting)_Prevention_Cheat_Sheet#XSS_Prevention_Rules