Stephen is a web developer in the InterCall Systems. He was working on a Real Estate website for one of his clients. He was given a task to design a web page with properties search feature. He designed the following searchpage.jsp
< form Id="form1" method="post" action="SearchProperty.jsp" >
< input type="text" id=''txt_Search" name="txt_Search" placeholder="Search Property..." / >
< input type="Submit" Id="Btn_Search" value="Search" / >
< /form >
However, when the application went to security testing phase, the security tester found an XSS vulnerability on this page. How can he mitigate the XSS vulnerability on this page?
- He should write code like out-Write ("You Searched for:"+ESAPI.encoder().encodeForHTML(search));
- He should write code like out.write ("You Searched for:" + request.qetParameter("search"l.toStrinq(ll;
- He should write code like out.write ("You Searched for:" + request.qetParameterf'txt Search"));
- He should write code like out.write (("You Searched for:" +(search));