Web security-XSS attacks

1. XSS
   XSS, which is (Cross Site Scripting), is called cross-site scripting in Chinese (the CSS abbreviation is not used to distinguish it from cascading style sheets). It happens at the browser level of the target user. When the process of rendering the DOM tree results in execution of JS code that is not expected, an XSS attack occurs.
2. XSS is divided into reflective XSS, storage XSS and DOM XSS
   (1) Reflective XSS: The XSS code is placed in the URL and submitted to the server as a parameter. After the server parses, it is sent to the browser as a response result, and finally executed through the browser's analysis.
   (2) Stored XSS: The XSS code is stored in the server. The XSS code is stored in the server after the first web page request, and the XSS code is directly obtained from the server when the same web page is accessed next time.
   (3) DOM XSS: mainly exploits code vulnerabilities on the browser side, such aswindow.eval()

XSS attack