== Reflective XSS See the HTML file below, which passes data to a JSP file. [source,html] -------------------------------------------------------
First Name:
Last Name:
------------------------------------------------------- Here is the JSP file: [source,html] ------------------------------------------------------- Using GET and POST Method to Read Form Data

Using POST Method to Read Form Data

First Name: <%= request.getParameter("first_name")%>
Last Name: <%= request.getParameter("last_name")%>
------------------------------------------------------- As you can see the JSP file prints unfiltered user input which is never a good idea. You want people to access the page like this: ---- http://hostname.com/mywebapp/main.jsp?first_name=John&last_name=Smith ---- But what happens if someone uses this link: ---- http://hostname.com/mywebapp/main.jsp?first_name= ---- === It is your turn! Try to prevent this kind of XSS by escaping the URL parameters in the JSP file: