This simple trick helps you fend off malicious script injections.
这种简单的技巧有助于避免恶意的脚本注入。
Now, an attacker would need to find somewhere to input a malicious script.
现在，攻击者需要找到某个地方来输入恶意脚本。
The malicious script introduced by the attacker is executed by the browser and the data is passed to the hacker's Web site.
于是浏览器会执行攻击者引入的恶意代码，数据将被传递到黑客的网站。
When an attacker introduces a malicious script to a dynamic form submitted by the user, a cross-site scripting (XSS) attack then occurs.
当攻击者向用户提交的动态表单引入恶意脚本时，就会产生跨站点脚本(XSS)攻击。
If the application has XSS holes, the attacker may send a malicious script that can still be executed by the application and lead to XSS intrusions.
如果应用程序有xss漏洞，攻击者就可能会发送能被应用程序执行的恶意脚本，导致XSS侵入。
For example, when you read strings out of a database, you should assume that they can contain malicious script.
例如，在从数据库中读取字符串时，您应该假定它们可能包含恶意脚本。
Cross-site scripting attacks allow hackers to embed a malicious script on your visitor's browser and then execute the script in order to gather data.
跨站点脚本攻击使黑客能够将恶意脚本嵌入到访问者的浏览器中，然后执行该脚本收集数据。
When the page is displayed, the malicious script runs, collects the users' cookies, and sends a request to the attacker's Web site with the cookies gathered.
显示该页面时，恶意脚本就运行，它收集用户的cookie，并向攻击者的网站发送包含收集到的 cookie 的请求。
Similarly, any time that you write a string into a page, you should assume that the string could contain malicious script (unless you programmatically created the string yourself).
同样，每次将字符串写入页时，您都应该假定字符串可能包含恶意脚本（除非您自己以编程方式创建了字符串）。
Malicious script that is embedded in input submitted to a Web site and later written back out to a client can appear to be originating from a trusted source.
嵌入到输入中的恶意脚本（提交到网站并且随后写回客户端）可以看起来像是来自受信任的源。
Malicious script that is embedded in input submitted to a Web site and later written back out to a client can appear to be originating from a trusted source.
嵌入到输入中的恶意脚本（提交到网站并且随后写回客户端）可以看起来像是来自受信任的源。
应用推荐