CYBERSECURITY TRAINING

Local XSS Demonstration Lab

Intentionally vulnerable application for controlled security education.

VULNERABLE MODE
⚠ INTENTIONALLY VULNERABLE — LOCAL LAB ONLY This mode deliberately demonstrates unsafe HTML output. Do not deploy this application to a public server.
01

Stored XSS Demonstration

Submit a comment and observe how it is rendered.

INTENTIONALLY VULNERABLE — STORED XSS

Harmless test payloads

For example:

<script>alert('Local XSS demo')</script>

Or a non-popup demonstration:

<script>document.body.dataset.xssDemo='executed';</script>

These examples only demonstrate JavaScript execution in this local page.

02

Reflected XSS Demonstration

Data is supplied through the URL and immediately reflected.

INTENTIONALLY VULNERABLE — REFLECTED XSS
Server response:
Nothing reflected yet.

Example

<script>alert('Reflected XSS')</script>

In Vulnerable Mode, the server places this user-controlled value directly into the HTML response.

03

Comment History

Comments are persisted in MySQL and rendered below.

No comments have been submitted yet.

What happened?

The application retrieved user-controlled text and inserted it into the HTML response without output encoding.

A browser interprets the resulting response as HTML. If the injected value contains executable markup such as a script element, the browser may interpret and execute it.

With stored XSS, the malicious test value is saved in the database first and can execute whenever the affected page displays that stored value.

With reflected XSS, the value comes from the current request and is reflected directly into the generated response.

How to fix it

Treat all user-controlled data as untrusted when it crosses into an HTML context.

htmlspecialchars( $value, ENT_QUOTES | ENT_SUBSTITUTE, 'UTF-8' );

Output encoding is context-dependent. This example protects values being placed into normal HTML text or attribute contexts. Other contexts, such as JavaScript, CSS, URLs, or SQL, require their own appropriate handling.

The database layer also uses PDO prepared statements so the demonstration does not unnecessarily introduce SQL injection.

Safe demonstration behavior