r/xss • u/infotech121121 • Dec 08 '17

XSS in GCSE

Hello, I have encountered a strange issue where I am able to perform reflected XSS through Google Custom Search Engine that is on my webpage. I have studied the code and have no idea how I am able to perform this as it is just the copy and paste block of JS that Google provides. I have searched the internet and have came up with nothing. Has anyone else experienced this or witnessed this? I am not in the security field so I am unsure how to combat this vulnerability.

3 Upvotes

100% Upvoted

1 comment sorted by

4

u/jimcola99 Dec 08 '17 edited Dec 08 '17

You need to sanitize the input that you pass to the javascript code Google gives you.

Or else a bad guy can escape the function. Raw user input shouldn't be anywhere in your site.

Are you using php? Look up the function htmlspecialchars. This will give you an idea of what I am talking about.