XSS is a large problem

Cross-site scripting (XSS) is one of the most rapidly evolving web application vulnerabilities. At the time of writing, a search for "XSS" on the common vulnerability and exposures database lists around 2,750 separate vulnerabilities.

The main reason for this is that it is often overlooked and underestimated by application developers. During penetration tests over the past year, we found that more than 80 per cent of web applications were vulnerable to XSS.

XSS can be defined as the execution of arbitrary client-side code (typically JavaScript/HTML), which has been injected by an attacker onto a web page. It exists wherever input from a user has been accepted and is echoed to an HTML page without being encoded.

Consider a typical website search using a URL-passed parameter query. A simple test is to enter a dynamic HTML into an input form. You should only do this against your own site.

Try submitting into the search form, with the <> signs. In many cases, there are "no search results", but you will see "0 search results" scrolling from right to left across the screen. This would indicate that the page was vulnerable to XSS as one has successfully injected an HTML tag into the results page.