Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Where does the snippet or Javascript get processed when we enter that in input box of HTML page or any URL?

Does it go to the server and come back or does the browser process it?

share|improve this question
Have you already read the Wikipedia article on Cross-Site Scripting, especially the part about the different types? – Gumbo May 16 '12 at 7:13
And you can also find many information for this subject in a simple [](Google Search). The reason I say that is beacause it's useless to describe here something that has been explained many times on the web. – Cyril N. May 16 '12 at 7:21
sorry i got it. – dany May 17 '12 at 12:46
up vote 1 down vote accepted

Does it go to the server and come back or does the browser process it?

Actually, both. When you enter some data in a form field and send it, the server does something with this data (it typically saves it into a database). If the data contains Javascript code, the server doesn't care, it just saves it as if it was normal text (remember that Javascript is a client-side language, the server cannot execute it).

When you want to view this information that has been saved in the database, the server sends the requested data back to the user. This data is handled by the browser, which will care about rendering the webpage. If the requested data contains Javascript code, this will be executed in this moment.

share|improve this answer
thanks a lot for this info.I got the answer for my question. Does it go to the server and come back or does the browser process it? what i meant was weather the browser process it without sending it to server. i m a newbie sorry if any mistakes.. – dany May 17 '12 at 12:29
@dany you're welcome. Mark the answer as accepted if it answered your question. Javascript code is processed when the webpage is rendered, so when you ask for the information, not when you enter it, meaning that if you enter some malicious code into a form field, you won't see its effects when you insert it, but only when you try to view that information again. – user1301428 May 17 '12 at 12:44
@ user1301428 ..yes i did and thanks a lot for info – dany May 17 '12 at 12:49
@dany to do it you need to click on the checkmark under the arrows on the left of my answer ;) – user1301428 May 17 '12 at 12:56

You should first learn, how the browser works... Read this

share|improve this answer
Thats a good link. Though I don't know why you'd ask to read all that just to understand how XSS works ! – CodeExpress May 16 '12 at 18:46
thanks a lot...pls let me know if there is any other similar site which explains about web server working.. – dany May 17 '12 at 12:32

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.