Improving Web Application Security: Threats and - CGISecurity

610 Part V: Assessing Your SecurityThe following table shows some common situations where Response.Write is usedwith input fields.Table 21.1 Possible Sources of InputInput SourceExamplesForm FieldsResponse.Write(name.Text);Response.Write(Request.Form["name"]);Query StringsCookiesSession and ApplicationvariablesDatabases and datastoresResponse.Write(Request.QueryString["name"]);Response.Write(Request.Cookies["name"].Values["name"]);Response.Write(Session["name"]);Response.Write(Application["name"]);SqlDataReader reader = cmd.ExecuteReader();Response.Write(reader.GetString(1));Identify Potentially Dangerous HTML Tags and AttributesWhile not exhaustive, the following commonly used HTML tags could allow amalicious user to inject script code:●●●●●●●●●●●●●●HTML attributes such as src, lowsrc, style, and href can be used in conjunction withthe tags above to cause XSS.For example, the src attribute of the tag can be a source of injection as shownin the following examples.The tag also can be a source of injection by changing the MIME type asshown below.alert('hello');