Javascript / Ajax

Review - JavaScript: the good parts

In my opinion "JavaScrip: the good parts" is a good book. It is a little bit different than other books i have read so far but it contains a few great fragments and just for that reason it is worth reading it.

The book is very short but it is a good thing. Author expects some knowledge of programming and JavaScript it self and does not waste time on lengthy examples or tedious explanations. Book is focused all the time and reading it is quite entertaining.

Review - Even Faster Web Sites

Finally i got a book that is truly worth recommending! It is a very good book and i think every web developer should read it.

Book is a sort of a continuation of another good book High performance websites but to be honest i think i like this one more.

Book is very condensed, there is no wasted page in it. Information is well structured and you can see that authors prepared well for the publishing. Information is backed by a decent research and some of the tricks are really cool.

Ultimate web developer's encoder / decoder

I am happy to present the first release of Ultimate web encoder.

I am a developer and i work a lot with ajax, javascript, PHP, json etc. It is quite often that i need to decode, replace encode something and i always go through the same process of searching for base64 encoder or decoder or other tools via google.

So lately i thought 'how about i do it once and for all', and this is how Ultimate web encoder came to live : )

It is a free online tool that will let you build a chain of transformations with a few simple frag and drops. It will also allow to apply the transformation multiple times as you do not even reload the page. Its all AJAX under the hood.

Using google analytics to track outgoing clicks

I just came across a very nice example of how to track external clicks on your website.

Where can an XSS injection occur on your page - different scopes need different escaping

XSS can be caused by inserting pieces of html or javascript in different places of the page (HTML) or CSS / JS files loaded.

To prevent XSS you will have to escape all the strings coming from GET/POST/COOKIES before you output them. You should escape things that come from other sources as well in case there is XSS attack string (for example dont include posts from RSS without escaping them properly).

Why you should not insert variables into your dynamic CSS files

When i say you should not generate CSS files dynamically i mean actually you should not put PHP variables into it.

From my experience it causes all sorts of problems from security to performance and caching. If you do not have to do it just don't. You cant still merge CSS files to have less requests per page and this is fine, but do not generate each file dynamically just join them and make sure its a safe way to do so.

Type of XSS attack where you inject JS into the links on the page

Some websites validate some bits and pieces but fail in other cases assuming that user will not pass anything strange there.

French OS Con website is and example of that XSS security risk.

Locating simpliest XSS vulnerabilities

The simplest way to find XSS security hole is to look for forms and ajax calls that result in printing request parameters on the returned page.

Here is some simple example which took 5 mins to find. Just go to a website you want to verify and look for forms and action urls.

This example shows UCD website XSS vulnerability (possible in 2010).

This is a sample to show how to locate XSS attacks, do not try to hack sites this way

XSS attack within CSS file or injected into page inline style

There is a very little known method of injecting javascript int CSS files. It would not work in all the browsers (works in my latest IE8) but it is important fact to know.

Basics of Cross Site Scripting AKA XSS and XSFR

Cross site scripts lead to a number of security issues. The most important to remember are:

  • Session Hijacking - hacker steals user's session by getting his cookies and gets access to user's account
  • Cross Site Forgery Request - hacker uses users account to perform operation that was not intended at all
Syndicate content

About the author

Artur Ejsmont

Hi, my name is Artur Ejsmont,
welcome to my blog. I am a passionate software engineer living in Sydney and working for Yahoo!

Web Scalability for Startup Engineers

If you are into technology, you can order my book Web Scalability for Startup Engineers on Amazon. I would love to hear what are your thoughts so please feel free to drop me a line or leave a comment.

Follow my RSS