zakirkun HTML Injection
Overview
HTML injection allows attackers to insert arbitrary HTML markup into web pages. Unlike XSS, HTML injection may not involve script execution (e.g., blocked by CSP) but can still:
- Redirect users via injected
<meta refresh> - Spoof content with injected forms (phishing)
- Manipulate page structure to mislead users
- In some contexts, escalate to XSS
Remediation
- HTML-encode all user output:
htmlspecialchars(),html.escape(),template.HTMLEscapeString() - Use auto-escaping template engines