anil<script>alert(1);</alert>. The modified data is stored in the database, but when I refresh the page, I do not see any popup message. How can I make sure I'm not vulnerable for Cross Site Scripting?
Testing for Cross-Site Scripting is unfortunately not completely straightforward . Depending on where your input is returned, you might need to use a number of different vectors to test it completely.
If you want to use an automated tool to review your site, something like arachni might be a good idea, or burp pro's scanner if you have access to that.
From a manual perspective, you can get an idea of the range of possible vectors from the list at html5sec
What you're doing depends on two things happening
Developers are supposed to check input for bad stuff, make sure the input is html encoded and reject the bad stuff like markup. On the other side the developer should make sure that anything that did make it into the database gets rendered harmlessly.
Hope This Helps!
There are three basic approaches to security testing - as with any other testing. This is the framework that I've put together for the fortune 500 company where I am responsible for defining the security testing strategy. This is based on standard QE/QA test practices, just expanded to address "security" features.
Hire experts. They are very expensive and will generally not test your entire product. Or, if they do test your entire product, it is absurdly expensive.
Automated testing, using scanners. This covers you for the most basic of vulnerabilities but scanners are dumb, and miss a lot.