XSS Attacks

86 Chapter 3 9 XSS Theory

var name = 'guest';

}

$('#content ') .html('<p>Welcome ' + name + ' I You can type

your message into the form below.</p><textarea class="pane">' + name + ' &gt;

</textarea>');

</script>

<div id=" footer" >

<p>Awesome AJAX Application</p>

</div>

< / body >

</html>

While the new application is an improvement, it could still be vulnerable to an attack. If

there is another Web application on the same server that has a XSS flaw, it could be lever-

aged against our chat application. This would be accomplished by injecting something sim-

ilar to the following