how to prevent cross-site scripting in an InfoPath form

easyeman — Wed, 21 Dec 2011 00:40:27 GMT

We have InfoPath forms implemented in several areas of the site to submit requests. An example is a Request form to ask a question to a staff member who can reply to the message as well.

There is the possibility that someone can enter in JavaScript, such as (<script> alert(“attack”) </script>) in one of the editable controls (subject or message body) and submit data in InfoPath. The JavaScript code then fires on the staff side with that page getting the alert Message. I've researched a lot but haven't found a definitive answer.

Is there any direct way to restrict/prevent XSS for this type of validation? Any suggestions would be helpful.

Thanks in Advance!

General

how to prevent cross-site scripting in an InfoPath form