I have a strange problem when i visit some page like this
example.com/node/386 "onmouseover=prompt(9999) "
from Drupal perspective that page doesn't exists right ?
getting something like this
Drupal Answers is a question and answer site for Drupal developers and administrators. It only takes a minute to sign up.Sign up to join this community
I was alterting the body class array for some reason with a non safe code.
$variables['classes_array'] = 'mysite-'.arg(0);
Now, changed to
$variables['classes_array'] = 'mysite-'.check_plain(arg(0));
Encodes special characters in a plain-text string for display as HTML.
PHP strip_tags will work too.
(PHP 4, PHP 5) strip_tags — Strip HTML and PHP tags from a string
Hope someone finds it helpful.