Question

xss 漏洞修复室 <script>alert('xss')</script>，应该放在哪？我的站源码如下：

<%
classtype=request.QueryString("classtype")
bigclass=request.QueryString("bigclass")
if bigclass="" then
rs.open "select * from news where ntype='"& classtype &" ' order by id desc",dconn,1,1
bigclass=rs("bigclass")
else
rs.open "select * from news where bigclass='"& bigclass &"' order by id desc",dconn,1,1
end if
%>

Answer 1

<%
classtype=request.QueryString("classtype")
bigclass=request.QueryString("bigclass")
if bigclass="" then
rs.open "select * from news where ntype='"& classtype &" ' order by id desc",dconn,1,1
bigclass=rs("bigclass")
end if
rs.open "select * from news where bigclass='"& bigclass &"' order by id desc",dconn,1,1
%>
<script>alert('xss')</script>