Hot answers tagged


You definitely don't have to worry about setting the action on your form. This is because it isn't being set from user input. The issue isn't setting it, but setting it based on user input and therefore potentially setting it to a dangerous value. If you control what it is set to then an attacker can't inject anything, and therefore there is no avenue for ...

Only top voted, non community-wiki answers of a minimum length are eligible