Common · OWASP Top 10
Cross-site scripting (XSS)
Cross-site scripting lets an attacker run their own script in your visitors’ browsers, to steal logins or change what they see on your pages.
Why it matters to you
Comment boxes, profile fields, search results and contact forms all repeat what a visitor typed. If that text isn’t escaped, it can run as code in the next visitor’s browser, including yours.
Check it yourself
- 01Search your templates for output that isn’t escaped.
- 02On a copy of your own site, enter a harmless test script in a form and see whether it appears as text or runs.
- 03Watch the browser console for content security policy errors after you add one.
Fix it
- 01Escape output for where it appears:
htmlspecialcharswithENT_QUOTESin PHP. In Laravel, Blade’s double braces escape by default and the{!! !!}form does not. - 02Add a Content Security Policy to limit which scripts can run.
- 03Sanitise rich text with an allow-list library.
- 04Set session cookies HttpOnly and Secure.
How PatchRig helps
PatchRig finds the unescaped outputs, fixes them on a copy, and adds a content security policy that fits your site.