312-49 · Question #314
You are carrying out the last round of testing for your new website before it goes live. The website has many dynamic pages and connects to a SQL backend that accesses your product inventory in a data
The correct answer is B. Your website is vulnerable to CSS. The code referenced (typically a script tag such as <script>alert('This is a test')</script>) is a standard Cross-Site Scripting (XSS) test payload. XSS was historically called CSS (Cross-Site Scripting) before the term was changed to avoid confusion with Cascading Style Sheets.
Question
You are carrying out the last round of testing for your new website before it goes live. The website has many dynamic pages and connects to a SQL backend that accesses your product inventory in a database. You come across a web security site that recommends inputting the following code into a search field on web pages to check for vulnerabilities:
When you type this and click on search, you receive a pop-up window that says:
"This is a test." What is the result of this test?
Options
- AYour website is vulnerable to SQL injection
- BYour website is vulnerable to CSS
- CYour website is vulnerable to web bugs
- DYour website is not vulnerable
How the community answered
(31 responses)- A6% (2)
- B77% (24)
- C13% (4)
- D3% (1)
Explanation
The code referenced (typically a script tag such as <script>alert('This is a test')</script>) is a standard Cross-Site Scripting (XSS) test payload. XSS was historically called CSS (Cross-Site Scripting) before the term was changed to avoid confusion with Cascading Style Sheets. When the browser executes the injected script and displays the alert pop-up, it confirms that the site does not sanitize user input, making it vulnerable to XSS attacks. SQL injection would require SQL syntax (e.g., ' OR 1=1--), not JavaScript.
Topics
Community Discussion
No community discussion yet for this question.