The following scripts calling my C# code :
`**<html>
<body>
<form action=https://www.website.net/search_function.aspx method="POST">
<input type="hidden" name="action" value="search" />
<input type="hidden" name="value" value="1"onfocus="alert`1`"autofocus="" />
<input type="submit" value="Submit request" />
</form>
<script>
history.pushState('', '', '/');
document.forms[0].submit();
</script>
</body>
</html>**`
and here is AJAX call and C# Call
`protected void Page_Load(object sender, EventArgs e)
{
try
{
if(IsValid)
PerformSearch();
}
catch (Exception ex)
{
Util.SendErrorEmail(ex);
PerformSearch();
}
}`
`$.ajax({
url: BasePath + 'search_function.aspx',
data: 'action=search&value=' + t.value,
type: 'post',
cache: false,
success: function (html)
{
results.stop().show().fadeTo(250, 1);
results.html(html);
spinner.html("");
var addValue = 200;
if ($('#ctl00_cph_searchControl_hidIsIndex').val() == "1") {
addValue = -450;
}
});
BindResultsHover(); //bind our results hover listener to the new results
}
});`
and this my page : apsx page
<%@ Page Language="C#" AutoEventWireup="true" Inherits="search_function" Codebehind="search_function.aspx.cs" %>
How I can prevent XSS in this ?
I have tried to add IsValid it working on local but not working server.
`**if(IsValid)**
New contributor
user24846708 is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.