Cross-Site Scripting — Live Lab

A real guestbook backed by a Flask session. Post a comment, then flip between vulnerable and secure rendering to see stored XSS fire — and get neutralized.

Educational purpose only. This app really executes the HTML/JS you submit when in Vulnerable mode. Only try it against this local demo — never against systems you don't own or have permission to test.
⚠ Vulnerable mode ✓ Secure mode
Guestbook (rendered with |safe — raw HTML)
No comments yet. Post one below.
<script>alert('XSS')</script>
<img src=x onerror="alert(document.cookie)">
<svg onload="alert('pwned')">
<b>this is just bold text</b>
Click a payload to drop it in the comment box, then Post Comment in Vulnerable mode. This demo sets a real (non-httponly) demo_session cookie scoped to this page so document.cookie has something to steal.
Attack State
Modevulnerable
Comments stored0
TypeStored XSS
Prevention:
• Escape output on render (Jinja autoescape,
  React JSX, textContent not innerHTML)
• Content-Security-Policy header
• HttpOnly + SameSite cookies
• Sanitize/allowlist rich-text input