CODEWITHSUNDEEP
htmlasp-classicxss
Raven13
Raven13

Reputation: 123

XSS mitigation in HTML/VBScript/Classic ASP

I'm faced with the following hypothetical XSS vulnerability in my web code:

original code: <INPUT TYPE=HIDDEN NAME='acctno' VALUE='" &Session("acctno")& "'>

hacked code: <INPUT TYPE=HIDDEN NAME='acctno' VALUE='12345'/><script>alert(98765)</script>

Can I mitigate this simply by adding HTMLEncode to the session variable in the value field?
Thanks.

Upvotes: 0

Views: 1070

Answers (1)

SLaks
SLaks

Reputation: 887459

Exactly. You need to HTML encode all text that gets inserted into the HTML.

You also need to Javascript-encode any text that gets inserted into Javascript code, and you need to URL-encode any text that gets inserted into URLs.

Upvotes: 1

Related Questions