I am a beginner who is trying to understand XSS. I want to make my own site and am very curious about how to detect if any of the HTML tags are vulnerable to XSS (like if the <src> or <a> tags).

Below is an example HTML block that I'd like to test:

<a href="javascript:s=document.createElement('script');s.src='http://localhost/s.js';document.body.appendChild(s);window.location='http://www.google.com/'">click</a>

Should I save this code as index.html and run this locally with an Apache server to detect XSS?

  • 1
    You test it on places where you accept input from the user of some kind – Tryna Learn Somethin Aug 3 '18 at 21:30
  • 1
    Your question does not make sense to me. It seems like you don't know enough about XSS to state a good question about it. Maybe you can try the XSS game to learn more about XSS. – Sjoerd Aug 4 '18 at 16:39

XSS typically affects locations where a user can type in input, ie. comment fields, username / password entries, even the url can be susceptible to XSS.

There are two main types of XSS, reflective and persistent. Reflective affects the user that typed in the commands, and persistent affects anyone that visits that page. Both are the same except for the fact that persistent needs to be stored on the server somewhere, in a comment field is a common one, so that it can be loaded by other users when they visit the page.

The best thing to do is create some kind of input validation that removes all special characters or any other type of character that you don't want on your site. Regex are a common and simple method to remove and sanitize your users input. I'll write some code below in PHP that you can use to sanitize input:

Method 1

    function clean($string)
        $string = str_replace(' ', '-', $string);
        $string = preg_replace('/[^A-Za-z0-9\-]/, '', $string);
        return preg_replace('/-+/', '-', $string)

Method 2

PHP has built in functions that you can use to sanitize input as well.

if (isset($_POST['submit']))) {
    $sanitized_input = filter_input(INPUT_POST, 'username', FILTER_SANITIZE_ENCODED, FILTER_FLAG_STRIP_HIGH);

As for the testing of whether the page is still vulnerable, I usually spring up a WAMP / LAMP server and just run the page locally, since it is the easiest and fastest method for quick testing and validating (for me).

If you want some more info on this leave a comment below and I can link you some material for further reading, or answer any more questions you have.

Not the answer you're looking for? Browse other questions tagged or ask your own question.