<script> tag not been processed in textarea

Collapse
X
Collapse
 
  • Page of 1
  • Time
  • Show
Clear All
new posts
Previous template Next
  • Rishabh Chandra
    New Member
    • Dec 2010
    • 9
    #1

    <script> tag not been processed in textarea

    Hello,

    To demonstrate XSS attack, I am building a web app which does the following:

    1. Works like a forum
    2. Takes posts from users via a HTML textarea and store these messages in the mysql db
    3. Displays all posts from the users on a thread. The objective is to show an XSS attack such as
    Code:
    alert("attack");
    due to insufficient filtering of the input.

    I am using a MySql db with Apache and PHP.

    On entering the following input into the textarea:

    Code:
    <script>alert("attack");</script>
    The data is just not being added to the DB and the $_POST method in the page which stores the posts into the database is returning an empty string. However, all other cases are working. I have so far not used any special functions used for input filtering in PHP, as this is an app to demonstrate XSS.

    However, on manually adding the above script into the DB, the expected alert box pops up.

    Anyone knows what's going on?
    Tags: apache, mysql, php, textarea
    • abhishekmiet
      New Member
      • Mar 2011
      • 8
      #2
      This worked well on mysql V5.5.8
      Code:
      <?php
	if(isset($_POST['name'])){
		$name=$_POST['name'];
		$dbc=mysqli_connect('localhost','root','','test') or die("Error connecting database...");
		$query="INSERT INTO test (name) VALUES ('$name')";
		$result=mysqli_query($dbc,$query) or die("Error querying database.$query");
		echo "Successfully inserted.";
	}
?>
<html>
<head>
<title>Hack It</title>
</head>
<body>
	<form method="post" action="<?php echo $_SERVER['PHP_SELF'];?>">
	<input type="text" name="name">
	<input type="submit" value=" Submit " name="submit">
	</form>
</body>
</html>
      Hey remember not to use this code,in hacking innocent people.

        Comment

        Previous template Next
        Working...