XSS in URI on page without input

Question

Is the XSS attack user-entered? I got these attacks:

'"--></style></script><script>alert(0x002357)</script>

when scanning a php page without html content using acunetix or netsparker.

Thanks in advance

Answer 1

, HTML - , SQL HTML , URI. URI , escape- - google escape-, , . - google for log injection. , , , - - , URI.

Answer 2

100%, . , , - XSS, , , .

XSS : , , .

, , , , (, - ). , , .

Answer 3

Blackbox , html - , , ), , PHP_SELF .

DOM Based XSS, , XSS - .

, , , , .

-, , JS, , javascript URL Rewrite (, ) - .

Answer 4

Where did you find this XSS? As far as I know, if the page does not accept any user input (process / display), it cannot be vulnerable to XSS.

Edit:

I think I misunderstood your question - did you mean if XSS can occur by entering Javascript in the address bar of the browser? Or adding Javascript to the URI? If the latter, then the page is susceptible to XSS, and you should use the whitelist for any variables passed to your URI. If the first, and then not, any changes on the client side in the address bar will be visible to only one user.