If one uses get parameter in the html code to send the request to the server the data we type is reflected in the url itself. This can be tampered directly in the url rather using the input field and hence may be used to tamper with the HTML code or the JS script i.e. vulnerable to Cross Site Scripting(XSS).
Hence change the request parameter to POST so that information is not reflected in the URL.
Here I have given a example of it. Although the js command is not executed but one can do it through other possibilities in future.
Here whatever I have written in the url is reflected in the search result.
Actually there is no need of search box now, one can directly type in the url to find the desired result
So it will be better if the request parameter is changed to post.
If one uses get parameter in the html code to send the request to the server the data we type is reflected in the url itself. This can be tampered directly in the url rather using the input field and hence may be used to tamper with the HTML code or the JS script i.e. vulnerable to Cross Site Scripting(XSS).
Hence change the request parameter to POST so that information is not reflected in the URL.
Here I have given a example of it. Although the js command is not executed but one can do it through other possibilities in future.
Here whatever I have written in the url is reflected in the search result.
Actually there is no need of search box now, one can directly type in the url to find the desired result
So it will be better if the request parameter is changed to post.