preventing cross site script attacks cross site script or xss is one of the popular methods for attacking not only to ajax based websites but almost any other website that accepts user inputs. Even before ajax was conceptualized, this attack was already practiced by different hackers. There was one hack that was used in 2005 wherein myspace.com was targeted. It uses a simple javascript function that could be embedded in user’s website and others. Once they view the webpage, the “my hero” link is changed to the name of the hacker. It is practically a pyramid hack since anyone who sees the profile became the host of the hack. The code was actually posted by the builder of the hack in possible reparation for what he did. It is just a simple javascript that could be embedded in any website. It just does not hack any information, it practically takes over every function it wants to. Here are some practices that will prevent future attacks using xss. read more...