title: Cross Site Scripting issue with document.write
body: <p>I am working with some old code which has been reported is vulnerable to cross site scripting. The line of code is</p>
  
  <pre><code>document.write("&lt;input type=hidden name=field1 value='" + getCookieValue('fieldval') + "' /&gt;");
  </code></pre>
  
  <p>The report also gave the following example on how malicious code can be injected into the page. By updating the cookie value as </p>
  
  <pre><code>fieldval='&gt;&lt;img src=x onerror=alert(1)&gt;
  </code></pre>
  
  <p>Can anybody provide insights on how this vulnerability can be fixed?</p>