A system for monitoring cross site scripting attacks, comprising: one or more processors; and memory to maintain a plurality of components executable by the one or more processors, the plurality of components comprising: a business module configured to receive and reply to a service request from a client terminal, a redefining module configured to: redefine a scripting internal function applied by a cross site scripting attack, and return redefined information for the scripting internal function to the client terminal, a monitoring module configured to monitor calling information of the client terminal in relation to the redefined scripting internal function, and, if the redefined scripting internal function is called, to record the calling information and send it to an analysing module, the calling information of the redefined scripting internal function comprising at least one of a context environment of the scripting internal function, a calling time period of the redefined scripting internal function, a number of calling times for the redefined scripting internal function, a behavior of a client that calls the redefined scripting internal function, or one or more accounts and IP addresses associated with the client,, and the analyzing module configured to analyze security of the calling information of the client terminal, wherein the analysis includes determining at least one of an attacking source, an attacking time period, leakage information in the attack, and a vulnerability point in the attack. one or more processors; and memory to maintain a plurality of components executable by the one or more processors, the plurality of components comprising: a business module configured to receive and reply to a service request from a client terminal, a redefining module configured to: redefine a scripting internal function applied by a cross site scripting attack, and return redefined information for the scripting internal function to the client terminal, a monitoring module configured to monitor calling information of the client terminal in relation to the redefined scripting internal function, and, if the redefined scripting internal function is called, to record the calling information and send it to an analysing module, the calling information of the redefined scripting internal function comprising at least one of a context environment of the scripting internal function, a calling time period of the redefined scripting internal function, a number of calling times for the redefined scripting internal function, a behavior of a client that calls the redefined scripting internal function, or one or more accounts and IP addresses associated with the client,, and the analyzing module configured to analyze security of the calling information of the client terminal, wherein the analysis includes determining at least one of an attacking source, an attacking time period, leakage information in the attack, and a vulnerability point in the attack. a business module configured to receive and reply to a service request from a client terminal, a redefining module configured to: redefine a scripting internal function applied by a cross site scripting attack, and return redefined information for the scripting internal function to the client terminal, redefine a scripting internal function applied by a cross site scripting attack, and return redefined information for the scripting internal function to the client terminal, a monitoring module configured to monitor calling information of the client terminal in relation to the redefined scripting internal function, and, if the redefined scripting internal function is called, to record the calling information and send it to an analysing module, the calling information of the redefined scripting internal function comprising at least one of a context environment of the scripting internal function, a calling time period of the redefined scripting internal function, a number of calling times for the redefined scripting internal function, a behavior of a client that calls the redefined scripting internal function, or one or more accounts and IP addresses associated with the client,, and the analyzing module configured to analyze security of the calling information of the client terminal, wherein the analysis includes determining at least one of an attacking source, an attacking time period, leakage information in the attack, and a vulnerability point in the attack.