XSS Testing Checklist for Small Projects
A lightweight checklist to catch common cross-site scripting weaknesses early.
XSS often appears in comment fields, profile pages, search parameters, and admin dashboards. Many cases come from one missing output encoding step.
Quick Test Areas
- User-generated text rendered in HTML templates.
- URL parameters reflected into page content.
- DOM updates using unsafe JavaScript sinks like
innerHTML. - Third-party widgets that inject untrusted markup.
Prevention Defaults
- Encode output by context (HTML, attribute, JavaScript, URL).
- Sanitize rich text input with allowlists.
- Use Content Security Policy as a second line of defense.
- Avoid inline scripts when possible.