When a value the client sent is placed into a page without escaping, the browser reads it as markup, and markup can carry a script. This set checks that you know why escaping is the fix, and why a header is a second line of defence.
Each one is marked as you go, and the explanation arrives straight after, which is
the part worth reading.
4 questions, marked as you go.
Tasks
These need your own device. Run the command in Termux, then paste what it printed.
The marking looks at what the output means, so spacing, version numbers and
ordering do not matter. If you have not installed anything yet, the
lesson covers the setup.
Show a payload reflected raw, then escaped
This builds a page fragment twice, once with the value placed in as-is and once with the same value escaped. The value is a script tag. Run it and paste both lines.
Run this in Termux
On your own device. Nothing on this page executes it. The command runs in
your terminal, and this box only reads what you paste back.
Two lines should come back. One still contains a live script tag, and one does not.
the raw line contains a live script tag
the escaped line replaces the angle brackets
the escaped line has no live script tag
the command actually ran
What a good answer looks like
Two lines. The raw line holds a live script tag inside a paragraph, which a browser would run. The safe line holds the same value with its angle brackets turned into < and >, so it shows as text and runs nothing. Comparing the two lines is the whole lesson: the value is the same, and only the escaping differs.
Marking your own work
Both halves of this are checked in your browser, with no server involved, so nothing
stops you from pasting output you did not run. The tasks are written so that the
easiest way to pass one is to actually do it and read the result, which is the whole
intention.