XSS Vulnerability Demo

This is an educational demonstration of Cross-Site Scripting (XSS) vulnerabilities. DO NOT use these patterns in production code!

Go to Vulnerable Page Go to Safe Page

✅ How to Prevent XSS Attacks

Best Practices:

Always use React's JSX (auto-escapes values)
Never use dangerouslySetInnerHTML with user input
Validate and sanitize all user input
Use Content Security Policy (CSP) headers
Set HttpOnly flag on session cookies
Use SameSite cookie attribute

Security Headers:

Content-Security-Policy: 
  script-src 'self'
X-Frame-Options: DENY
X-Content-Type-Options: nosniff
Set-Cookie: session=xyz; 
  HttpOnly; Secure; SameSite=Strict

Educational Use & Disclaimer

This demonstration is designed for educational purposes to help developers, security professionals, and students understand XSS vulnerabilities and prevention techniques.

By using this site, you agree to use this knowledge responsibly and only for educational purposes. Do not test these attacks on websites you do not own or have permission to test.