that is not really DB stuff, that is Javascript stuff.
DB stuff would be something like
";drop users; --
It is DB stuff because anything put into the DB eventually gets taken out and it needs to be translated into safe information before deposit. Yes there is script handing on removal
ok, you are right, that is stored xss
i remember that from a forum i ran as part of my job years ago, we found an xss bug in the php code and fixing it was difficult because it required rewriting all database entries to fix it. so we changed it to encode on the output and that was much easier and did not require any database encoding.
The only problem with that is it makes the DB non-modular at that point and anyone using it has to know to fix the data coming out but yes
and it is interesting how often that still works in a current website if it is new. i did a test on a portal maybe start of this year when I joined it and it worked to search for a XSS string in the search function and it would write out the title of the resulting web pages with the XSS code and would be vulnerable. i reported to the site admin and he fixed it in 1 day or 2
(post is archived)