Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have this snippet of code :

<script type="text/javascript">
                getUrlVars : function() {
                        var vars = [], hash;
                        var hashes = window.location.href.slice(
                                        window.location.href.indexOf('?') + 1).split('&');
                        for ( var i = 0; i < hashes.length; i++) {
                                hash = hashes[i].split('=');
                                vars[hash[0]] = hash[1];
                        return vars;
                getUrlVar : function(name) {
                        return $.getUrlVars()[name];

        $(document).ready(function() {
                //Getting URL var by its nam
                var langVal = $.getUrlVar('lang');

And I want to know , how secure it is.Is there any danger of dom xss and if yes , then how? Thanks

share|improve this question
up vote 1 down vote accepted

In its current state, your code doesn't have a DOM XSS vunerability. $.val sets the value of a form element, which cannot be used to inject JavaScript code into a website.

The innerHTML property or document.write are examples for methods that are vulnerable to DOM based XSS.

You should read up on this topic on the OWASP website. There's also a talk here about this topic (if I recall correctly, it was mostly about a tool to detect DOM based XSS, but also has an introduction to the topic).

share|improve this answer
Thanks you , now I can implement it in code. And thanks for links , I tried Dominator but got nothing, but tools make mistake so I asked. – khaomax Apr 25 '13 at 9:16

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.