Im just learning about IT security, so this is basic stuff and Im maybe overthinking it.

1. I have this input field on my wordpress site (ssl is on) that directs the user to the product he typed in:


<a target="_blank" id="reflectedlink" href="http://www.google.com/search">Button</a> <input id="searchterm"/>


// Adds string to href var link= document.getElementById('reflectedlink'); var input= document.getElementById('searchterm'); input.onchange=input.onkeyup= function() { link.search= '?q='+encodeURIComponent(input.value); }; // Fires button on enter keypress $("#searchterm").on("keyup", function(e) { if(e.keyCode == 13) { $('#reflectedlink')[0].click(); } });

It filters bad signs with encodeURIComponent() (so it should be fine if js is turned on?), however, if someone turns js off, can the input field be used for any kind of XSS attack or similar stuff? Do I need to validate this field in my functions.php or is it fine since there is no data being sent to the database and wordpress maybe taking care of it anyway?

2. I learned that innerHTML should be avoided, so I have this function to sort products, it uses jQuerys html() method (which does basically the same?):


<div class="wrap"> <button id="alphBnt">Alphabetical</button> <button id="numBnt">Numerical</button> <div id="container"> <div class="box"> <h1>B<h1> <h2>10.35</h2> </div> <div class="box"> <h1>A<h1> <h2>100.05</h2> </div> <div class="box"> <h1>D<h1> <h2>200</h2> </div> <div class="box"> <h1>C<h1> <h2>5,510.25</h2> </div> </div> </div>


var $divs = $("div.box"); $('#alphBnt').on('click', function () { var alphabeticallyOrderedDivs = $divs.sort(function (a, b) { return $(a).find("h1").text() > $(b).find("h1").text(); }); $("#container").html(alphabeticallyOrderedDivs); }); $('#numBnt').on('click', function () { var numericallyOrderedDivs = $divs.sort(function (a, b) { return $(a).find("h2").text() > $(b).find("h2").text(); }); $("#container").html(numericallyOrderedDivs); });

Is it fine to use in this context and does this whole "avoid innerHTML / html()" refer to its use in combination with input fields / any user input?


Regarding the input field I am asking about this exact scenario, it is not used to store any data on the server, all it does is to change an href and I am validating the input to this field with encodeURIComponent().

I wanted to know if the following is correct:

If the client's js is on, the input gets validated, if not I don't have to validate the input since this input field is basically just that, an input field without interaction with the server or the client (aside from typing digits in it) and therefore can not be used for an attack (assuming the rest of the site / server is secure).

Thanks in advance for any help / hints.

  • You'd be better off adding the sorted DIVs as DOM elements, rather than as HTML, but as long as users can't control the DIVs directly and your database is clean (i.e. has no HTML entities in the text it returns, or if it does they are escaped) the second part is OK. – CBHacking Aug 18 '17 at 23:52
  • The questions should be self-contained, without relying on specific links that might become broken in the future. Thus, I VTC until this is edited. On-topic Hint: depending on JS to validate or escape your input is exactly the same as depending on your users not typing in malicious things. – Tobi Nary Aug 19 '17 at 6:23
  • These are two independent questions and thus should be asked as separate questions. Also, as @SmokeDispenser already said: all needed information should be inside the question and not rely on external resources which might vanish. – Steffen Ullrich Aug 19 '17 at 7:25
  • As far as OP is concerned, that is. And now I'll clear all comments, this is not a forum. – Tobi Nary Aug 20 '17 at 20:03
  1. "if someone turns js off, can the input field be used for any kind of XSS attack"? no, you need JS to pull off XSS, but a server is still needed to stop other attacks like SQLI, malware links/downloads, and CSS phishing.

  2. $(elm).html(str) is more dangerous than elm.innerHTML=str because it loads external scripts and eval()s any content in inline script tags, whereas innerHTML doesn't execute script tags. Both are susceptible to attribute-based attacks like onmouseover=alert(666) however, so sanitize all user-submitted content on a server before serving to other users.

EDIT: I should mention that you can safely use elm.innerText=str on arbitrary input, and it preserves some human-desired formatting and special chars, without any XSS risk. $(elm).text(str) does about the same thing, so it's also safe.

  • 1. Is wrong. This is only true for non-persistent XSS. If persistent XSS is possible by disabling JS, turning JS off is fine - it is enabled when the XSS is served to other users. – Tobi Nary Aug 20 '17 at 13:56
  • @SmokeDispenser: OP indicated no DB in play, so presumably we only need to cover reflections like linked search results. – dandavis Aug 20 '17 at 19:53
  • OP explicitly says Wordpress. Wordpress uses a DB. So there might be persistence attacks. – Tobi Nary Aug 20 '17 at 19:59

Not the answer you're looking for? Browse other questions tagged or ask your own question.