Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

If somebody can edit $("#field").val(), can they change the url property here to point to another location?

  url: "http://mywebsite/script?param=" + $("#field").val(),
  dataType: "jsonp",
  success: function(response) {
      document.write(/*fields from response object*/);

If they can then my page is XSS vulnerable since the malicious location could return script tags in the response object. I want to know if any value of field could be used to change the AJAX url.


My apologies, I have updated the question. The value is actually contained in a javascript variable and is not directly written by php (otherwise there is obviously XSS issues). Sorry.

share|improve this question
I think we would need to see the code of your server side script. Also, those files referenced by fname, are they HTML files, or plain text? – George Bailey Jan 19 '12 at 13:40
fname is just any parameter entered by the user eg from a GET request. – Kevin Jan 19 '12 at 13:47
Yes, but I suspect that based on what they enter into fname, results will come out. What do those results look like? – George Bailey Jan 19 '12 at 16:18
Wow thats an obvious xss flaw. Perhaps you should brush up on the basics before burdening others with such questions. – rook Jan 19 '12 at 16:30
@Rook yep, see update. – Kevin Jan 19 '12 at 21:58
up vote 13 down vote accepted

Yes it is vulnerable, but not it the way you suspect. The attacker would not try modify the loaded URL, but to execute the code directly. For example:

$_GET['fname'] = '"+(function(){/*any_code_i_like*/})()+"';

will become:

   url: "http://mywebsite/script?param="+(function(){/*any_code_i_like*/})()+""

and the code will execute even before requesting the URL with ajax. It's just an example, there are other vectors that would work here too. The simplest way to escape the parameter to prevent XSS in this context would be using urlencode() in PHP like this:

  url: "http://mywebsite/script?param=<?php echo urlencode($_GET["fname"]); ?>"
  dataType: "jsonp",
  success: function(response) {
      document.write(/*fields from response object*/);

Also, take a look at OWASP XSS Prevention Cheat Sheet.

Update: After you updated the question - there is no XSS vulnerability here (you can't e.g. point the request to another domain), but the example is vulnerable to a different beast - HTTP parameter polution. It might not matter in this exact case, but imagine that the given parameter is:


The attacker is able to inject additional HTTP GET parameters which might be important for your application and might change the execution flow (e.g. parameter admin=1). You should get into habit of escaping/encoding everything coming from user input. In this modified case you should use Javascript encodeURIComponent function which prevents attacker from injecting '&','=' and '?':

"http://mywebsite/script?param=" + encodeURIComponent($("#field").val()),
share|improve this answer
Hi, thanks for answering my question. I actually realised that the input is not directly added by php, see update. – Kevin Jan 19 '12 at 21:57
Thanks, exactly what I needed to know – Kevin Jan 21 '12 at 0:24

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.