HTML Injection

Web vulnerability where an attacker injects arbitrary HTML (or JavaScript) into a page that is rendered by browsers. When the input isn’t properly sanitised, the attacker’s code can:

• Alter page structure (e.g., add links or forms).
• Execute scripts in the victim’s browser (Cross-Site Scripting (XSS))
• Steal data or perform actions on behalf of the user.

Examples

Displaying unsanitised name-input

The below code takes a name that is will display. This name can however be anything and if we submit some HTML code it will render it on the page.

<!DOCTYPE html>
<html>
<body>
    <button onclick="inputFunction()">Click to enter your name</button>
    <p id="output"></p>
 
    <script>
        function inputFunction() {
            var input = prompt("Please enter your name", "");
 
            if (input != null) {
                document.getElementById("output").innerHTML = "Your name is " + input;
            }
        }
    </script>
</body>
</html>

Since everything happens in the front-end the page will be reset when refreshing the page.