XSS：还有问题吗？
我说 XSS 不再是一个问题对吗？既然 IE 8/Chrome 无论如何都会阻止它吗？
Am I right to say that XSS isn't such a problem anymore? Since IE 8/Chrome block it anyway?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（3）
不会。如果页面存在漏洞，您仍然可以利用 XSS 漏洞。
No. You can still exploit XSS vulnerabilities if a page is vulnerable.
是的，浏览器已经改进了针对 XSS 攻击的分配。但请永远强制用户输入。例如，XSS 攻击策略仍然有效。
- 转义 HTML 标签。
当您的用户能够保存搜索结果并与其他用户共享并且用户保存此结果时：
" />< /code>" />关闭标签并使其可以在其后输入黑客代码。可以窃取会话、插入图像或将用户重定向到另一个网站。这只是一个仍然有效的小例子，还有更多。自己尝试一下吧！
更多信息：http://heideri.ch/jso/#html
Yes, browsers have improved allot against XSS attacks. But please, NEVER thrust user input. For example a XSS attack tactic that still works.
- Escaping HTML tags.
When your users has the ability to save search results and share them with other users and the user save this result:
" /> <iframe src=[malware]></iframe>the" />shuts down the tag and makes it possible to enter the hackers code after it. Making it possible to steal sessions, insert images or redirect the user to another website.This is just a little example that still works, there are allot more. Try it yourself!
More info: http://heideri.ch/jso/#html
恶意用户并没有消失。
主流浏览器中的许多 XSS 漏洞已被修复，但人们仍然可以通过多种方式利用您。
唯一改变的是，作为开发人员，防御 XSS 变得更容易，因为需要阻止/监视的内容更少。
Malicious users have not disappeared.
A lot of XSS loopholes have closed in major browsers but there are still plenty of ways people can take advantage of you.
The only thing that's changed is that as a developer, defending against XSS is easier since there are less things to block / watch for.