Maybe not everyone knows this, it's called XSS. There is a good cheat sheet to protect against issues like this from OWASP : https://www.owasp.org/index.php/XSS

Maybe not everyone knows this, it's called XSS. There is a good cheat sheet to protect against issues like this from OWASP : https://www.owasp.org/index.php/XSS_(Cross_Site_Scripting)_Prevention_Cheat_Sheet https://www.owasp.org/index.php/XSS_(Cross_Site_Scripting)_P... Shameless plug: We develop a tool that detects vulnerabilities such as this automatically (even in JavaScript based web apps) - https://www.netsparker.com/netsparker/ https://www.netsparker.com/netsparker/ There is also a free community edition which would possibly detect this vulnerability : https://www.netsparker.com/communityedition/ https://www.netsparker.com/communityedition/