If an application on the server generates a web page in response, it is possible that the script could be embedded within the page, and would run when processed by the user s browser. Whether or not a web site is affected by the vulnerability depends entirely on the applications running on the web server. If they follow recommended practices, and validate all inputs before using them, the site would not be affected. However, an informal survey shows that a large number of web sites do not do so, and could be affected by the vulnerability. A script is a type of computer program frequently used in web programming.
Scripts consist of text commands.
Anytime a program accepts an input from a user, it should examine it to make sure that it is valid that its length and content are appropriate. In the case of this vulnerability, an application could only be affected if it blindly used the information it received without vetting it first. It s well established that programs always need to validate user input before using it. As a general coding practice, it s well-known that programs need to always validate inputs before using them. However, there are two elements of this issue that warrant advising customers about it.