Programmers Stack Exchange is a question and answer site for professional programmers interested in conceptual questions about software development. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

If I am taking data from a website, for example status updates from Facebook and showing them on my website. What possible damage can be caused if I am not taking into account that the code written as status update would execute on my website?

For example, Mr. Simon has putted his status update,

"<p style="color:red;">I love to code</p>"

Now, when I display this on my website, it transforms into the text I love to code written in red.

share|improve this question
Is you question just "What damage can an xss vulnerability cause?"? – CodesInChaos Mar 2 '13 at 11:12

Basically you will be vulnerable to XSS - the element might as well be a script element or the paragraph element could have an onmouseover etc attributes to run a script.

  • If you are not using HttpOnly session cookies, XSS can be used to steal sessions.
  • All security measures against CSRF are useless if you are vulnerable to XSS.
  • The script can dynamically load malicious java, flash, pdf etc plugin files, which can exploit bugs in the respective browser plugins.
  • The script can redirect the user somewhere else, hide your page or make for a convincing phishing page since it's on your domain.
  • Probably many more - only your imagination is the limit :)
share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.