A developer has executed code for a website that allows users to search for employees' phone numbers by last name. The query string sent by the browser is as follows: The developer has implemented a…

Question

Options

• ASanitization library
• BSecure cookies
• CTLS encryption
• DInput serialization
• EOutput encoding
• FPUT form submission

• A
  60% (21)
• B
  3% (1)
• C
  9% (3)
• D
  23% (8)
• F
  6% (2)

Explanation

The website is already using a sanitization library and stored procedures, but still vulnerable to XSS. XSS (Cross-Site Scripting) requires a two-pronged defense: sanitizing input AND encoding output. Output encoding (E) is the critical missing control - it converts special characters (like <, >, &) into their HTML entity equivalents before rendering them in the browser, preventing injected scripts from executing. Even with input sanitization, encoding output is essential because data may arrive from sources that bypassed input filtering. Re-evaluating or upgrading the sanitization library (A) is also appropriate since the current one is clearly insufficient. Secure cookies (B) and TLS (C) protect data in transit but do not prevent XSS. Input serialization (D) is not a standard XSS mitigation. PUT form submission (F) is not a security control.

No community discussion yet for this question.