Let us say your web app is sanitizing bad input and displaying the user what the bad input was. Before XSS measure was put in place web app is spitting out malicious script as is. For example Bad address value : <script>bad script goes here </script>

Now after careful sanitizing output could be something like this. Bad street address : sanitized input. If the input was let us say not script like !@#$ street then it would output Bad street address : !@#$

Do you think using word sanitized is too obvious for output string that is malicious. I figure regular users wont see this. But bad guys are the only ones will see sanitized. Or should the app not say anything at all if it sanitizes the input. Or should it replace some of the bad script tags with something other. What is the best known industry best practice here?


Any error message shouldn't provide information to the attacker other than their attempt was unsuccessful. Example: A password/username failure should say the attempt was bad, not whether the username was bad, or the password, or both. If it does, that information might be usable to an attacker in an effort to circumvent your safeguards. Something along the lines of: "Invalid Address" or "Address not Found" in the case of an Address field would be more than sufficient. The same goes for any other field as well.

Now, I am uncertain as to why you would re-display the malicious information to anyone attempting to insert malicious code into your system. It definitely reveals what is happening behind the scenes, instead of hiding the inner-workings of your system from the attacker.

The vaguer the better.


As Desthro said, an error message should not provide too much info to an attacker. The recommended practice is to display a static error message that does not include any of the user-provided data. Your error message should say no more than about "Invalid characters in street address." If you want to be more helpful, you could be a bit more specific and tell them "Street address must contain only letters, numbers, and dashes" (or whatever your scheme is.)

If you display any of the input in the output, you risk the possibility of creating some kind of unexpected XSS attack, the type you're trying to prevent. And it gives your legitimate users no added benefit.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.