	[x] Posted via EE Mobile
	Search, ask, and monitor your questions on the go with EE Mobile. Visit Experts Exchange from your mobile device and never be out of touch again.

Question

	[x] Attachment Details

[x]

The Solution Rating System

With so many solutions, how can you tell which solutions are most likely to help you and which ones are not? To provide you with a tool to use, we rate our solutions based on various elements that most accurately determine if a solution is a quality solution. To explain what factors affect the solution rating, here are the elements we take into consideration when formulating our solution rating.

The Grade of the Solution
The Zone Rank of the Expert Providing the Solution
The Number of Author and Expert Comments
The Number of Experts Contributing
The Feedback of the Community

Your Input Matters
Because of the way the system is set up, the most important variable in this equation is you. As a member of Experts Exchange, you are able to cast your vote on the quality of the solutions in regard to how complete, accurate, helpful and easy to understand each solution is. When you provide your feedback, each rating is adjusted accordingly. So, if you see a solution that has a poor rating that you think is a good solution, let us know by rating it. As you do, the rating will be adjusted and will become more accurate for other members of our site.

If you have any suggestions that you would like to make for our rating system, please ask a question in the Suggestions Zone of Community Support.

Thank you!

9.2

How can I protect my website from javascript injections or cookie edits?

Asked by stackshady in Security Issues in Programming, Linux Network Security, Miscellaneous Security

Tags: website, security, javascript, cookie, injection

I was browsing the web for possible security issues with my website, and I was shocked at what I found. I was able to login to administrator accounts without knowing username and login information, and do anything I wanted within my site.

I typed the following into the URL:
javascript:alert(document.cookie);

I store user login information in the cookie by using login=USER_ID

I then typed in:
javascript:void(document.cookie="login = 1");

This gave me access to my entire site!

So my question is....how do I prevent this? I'm assuming I'll have to recode how my site determines when a user is logged in.

Get your answer NOW

20091111-EE-VQP-89 - Hierarchy / EE_QW_3_20080625

Hall of Fame

1. richrumble4,100
2. MuraliKanth4,000
3. mrcoffee...3,600
4. jakopriit2,600
5. NovaDeni...2,500
6. rlandquist2,000
6. Locklear2,000
6. JimU2,000
6. MunterMan2,000
6. JBlond2,000
6. egrep2,000
6. leegclystv...2,000
6. hiteshgold...2,000
6. matthews...2,000
6. sdesign2,000
6. azadisaryev2,000
6. MSWarrior2,000
6. bec0s2,000
6. cminear2,000
6. GiftsonDJ...2,000
6. kevthedude2,000
6. i_t2,000
6. twocandles2,000
6. wht19862,000
6. AhmedC...2,000

1. mrcoffee...5,600
2. richrumble4,600
3. MuraliKanth4,000
4. jason11783,700
5. ahoffmann3,500
6. jakopriit2,600
7. TheLearn...2,500
7. Squinky2,500
7. NovaDeni...2,500
10. CoccoBill2,150
11. dvz2,000
11. rlandquist2,000
11. Locklear2,000
11. JimU2,000
11. Mikal6132,000
11. tedbilly2,000
11. WyTyz2,000
11. MunterMan2,000
11. cs97jjm32,000
11. BestWay2,000
11. LSMCons...2,000
11. gatorvip2,000
11. JBlond2,000
11. amahesh...2,000
11. egrep2,000
11. Ray_Pas...2,000
11. nedfine2,000
11. leegclystv...2,000
11. hiteshgold...2,000
11. franked_it2,000
11. mkielar2,000
11. matthews...2,000
11. sdesign2,000
11. azadisaryev2,000
11. khaledf2,000
11. MSWarrior2,000
11. bec0s2,000
11. cminear2,000
11. GiftsonDJ...2,000
11. kevthedude2,000
11. i_t2,000
11. twocandles2,000
11. wht19862,000
11. AhmedC...2,000

How can I protect my website from javascript injections or cookie edits?

Asked by stackshady in Security Issues in Programming, Linux Network Security, Miscellaneous Security

Tags: website, security, javascript, cookie, injection

About this solution