Multi tool use

Prevent XSS attack in Paypal html form

I have some problem with XSS scan on sitelock. They said that some of URL from html input form is vulnerable. They said each parameters which I sent through the form was vulnerable. In this case the vulnerability is from Paypal input form. I build my website with Paypal redirect so the user will input their own data into the form and the system will send it to paypal. This is the example of my form code:

That is some part of my form. What I want to know is whats wrong with that form and how to prevent Sitelock to scan XSS vulnerability ? Please anyone knows could help me.

2 Answers
2

I would also recommend using the HTTP header.

X-XSS-Protection: 1; mode=block


https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-XSS-Protection

you probably dont check/nullify the data you are getting in the input fields

and by typing alert('hacked') in billing_address field

alert('hacked')

on next page where you print the billing_address you will get a popup window calling hacked

On the page that process your form you should validate that input fields doesn't have any javascript code.

for example

<?php
// define variables and set to empty values
$name = $email = $gender = $comment = $website = "";

if ($_SERVER["REQUEST_METHOD"] == "POST") {
$name = test_input($_POST["name"]);
$email = test_input($_POST["email"]);
$website = test_input($_POST["website"]);
$comment = test_input($_POST["comment"]);
$gender = test_input($_POST["gender"]);
}

function test_input($data) {
$data = trim($data);
$data = stripslashes($data);
$data = htmlspecialchars($data);
return $data;
}
?>


you need to create a function like test_input and run for all your input fields

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.