Can HTML injection be a security issue?

Posted by tkbx on Programmers See other posts from Programmers or by tkbx
Published on 2012-11-27T23:04:56Z Indexed on 2012/11/27 23:28 UTC
Read the original article Hit count: 328

Filed under:

I recently came across a website that generates a random adjective, surrounded by a prefix and suffix entered by the user. For example, if the user enters "123" for prefix, and "789" for suffix, it might generate "123Productive789". I've been screwing around with it, and I thought I might try something out: I entered this into the prefix field:

<a href="javascript:window.close();">Click</a><hr />

And, sure enough, I was given the link, then an <hr>, then a random adjective. What I'm wondering is, could this be dangerous? There must be many more websites out there that have this issue, are all of them vulnerable to some sort of php injection?

© Programmers or respective owner

Related posts about security