Level 1: Reflected XSS & Entity Encoding
User URL search query is directly
rendered into innerHTML without encoding!
MALICIOUS ATTACK PAYLOAD
<script>alert('XSS Stolen Cookie: ' +
document.cookie)</script>
Select Sanitizer Code
Patch:
Payload Sandbox Inspector
UNSANITIZED RENDER
(VULNERABLE)
<script>alert('XSS')</script>
SANITIZED OUTPUT
(SECURED)
<script>alert('XSS')</script>