In cross-site scripting attacks, attackers insert attack scripts into your pages. Because no system is fool-proof, it may not be enough to screen the data that's submitted to an application. You should also escape any content sent to the user so that any malicious code that may have escaped your input screening is neutralized. Specifically, the characters crucial to forming HTML must be escaped:


||turn||into||

|&|&amp;amp;|

|<|&amp;lt;|

|>|&amp;gt;|

|"|&amp;quot;|

|'|&amp;#x27;|

|/|&amp;#x2F;|


This rule raises an issue for anything sent to ``++WEB++``.

== Noncompliant Code Example

----
...
EXEC SQL
  SELECT NAME
  INTO :PNAME
  FROM PRODUCT
  WHERE ID = :PRODUCT_ID
END-EXEC.

EXEC CICS
  WEB SEND  *> Noncompliant
  FROM(PNAME)
  *> ...
END-EXEC.
----

include::../see.adoc[]

ifdef::env-github,rspecator-view[]
'''
== Comments And Links
(visible only on this page)

include::../comments-and-links.adoc[]
endif::env-github,rspecator-view[]
