My question is three-fold.
I was asked to do some vulnerability scans on a website with some holes (I think). On a particular page, I was able to escape the text field and write on the site. If I left the site, the text I entered left.
1) How can I recommend a text field be secured (as far as validating input prior to be accepted to the html parser (which I learned runs before any of the other parsers))?
2) Is the fact that the text is non-persistant relevant? I can still put a script tag in there and it seems to run.
3) This one, I don't know if I can really expect to be answered; but, I lack imagination as to what I can do with this "hole." If I can run a script, I should be able to do something, but I don't think I know enough java script for that. What can be done (not really looking for code... necessarily...) with this?