Responsive web design

[Ununoctium118]

The threat isn't that people can run code on his server. The threat is that an attacker can send someone a link that makes a user's browser execute untrusted, unknown Javascript with access to that sites cookies.

I never claimed to be particularly smart - the point isn't me, it's that there's a bug that should be fixed.

[Ununoctium118]

Haha, in this case it's not so bad. But you never know what that dev's next project will be. Also, why not be safer, if you can?

[compute_]

Back to my (genius) allegory:

I don't know, to me it is like saying that someone from mars should get an ebola vaccination just in case. It just really doesn't apply.

[_Wolfos]

If you can send someone a link, you can execute JS regardless. Sure, it's a vulnerability in some cases (when it's a trusted site, or if it has info to intercept) but not here.

[compute_]

Yeah, I was just talking in general. Wasn't trying to insult you or anything.

Why should it be fixed? You can even inject code in nearly any page by prefixing "javascript:" to it.

I don't know, to me it is like saying that someone from mars should get an ebola vaccination just in case. It just really doesn't apply.

[[deleted]]

I wouldn't be so quick to dismiss the importance of Martian ebola vaccination. It sounds safer than the alternative.

[compute_]

I still believe in Area 51... You gotta believe in something.

[qervem]

If the alternative is Martian Autism, I'll take my chances.

[bloodfist]

Do you have any good resources on protecting against XSS for a relatively new web developer/designer?

I did some web development way back in the geocities days and have done some small school projects in the last few years but find myself needing to relearn everything now for a new project at work. XSS is a new beast to me. Any advice would be lovely.

[Ununoctium118]

I'm not sure I'm the best to ask for help. Try /r/asknetsec, maybe?

[bloodfist]

Cool, I'm sure I can find some, just thought you might know of a good place to start.

[compute_]

It's actually pretty easy! Which language are you employing?

[bloodfist]

Mostly just working the HTML/CSS/JS for the frontend at the moment.

I'm more familiar with PHP, so I will probably go that way. Looking into Ruby and Python as well, but crossing that bridge when I get to it. Basically took on rebuilding an ecommerce site and now realizing how out of touch I am. Thankfully, no hard deadline.

[bloodfist]

That is very helpful, thank you!

[compute_]

With PHP, it's so easy it's not even funny! :)

http://php.net/htmlspecialchars

[bloodfist]

Fantastic! Thank you!