Discussing XSS Injection.

[mandin]

For lack of a better word to use I am calling it XSS injection. I designed a Mediocre Ad network, Its functional, but I feel its based on the limits of my knowledge. Anyway I am using javascript to call PHP on another Server (XSS / Cross site scripting). I would like to share information with people who have experience with this.

Recently a publisher with a high visitor statistics signed up and was complaining that his server went down after adding our Code. My question is, Is it possible that my javascript code caused the server breakdown. We still arent sure if he had unusual traffic on that day or if its my code that caused it.

The way I look at it, his server just echoes out the javascript, and its at the users browser that the actual call to my server works. Right!! so if so then in now way should my code affect the publishers Server.

I am hoping you guys can share your knowledge with me and maybe direct me to online resources where I can learn more on Cross server Scripting, and the factors to consider.

[crmalibu]

Possibilities:
Your code has a bug, which causes it to request a url on thier domain instead of yours.
Your code conflicts with code on thier page(global variables/functions/event handler issues etc...).
Your website had loading issues, which may interfere with a browsers ability to quickly display the webpage because javascript may be waiting for something on your domain.

[mandin]

Possibilities:
Your website had loading issues, which may interfere with a browsers ability to quickly display the webpage because javascript may be waiting for something on your domain.

hmnn... very interesting... Are you for certain that the javascript will slow down the loading of the page, doesn't the site just download the javascript and the browser do the waiting... Wat are the ways to solve this problem cos I am certain the script is bug free and runs very speedily.

[crmalibu]

Yes, javascript has the ability to cripple loading of the page. Maybe you should make a post in the javascript forum with some actual details, and the code.

[mandin]

thanks alot. I will direct my post to that section