An attack that injects HTML code via vulnerable form inputs to change the appearance or information presented to users.

An attack that injects HTML code via vulnerable form inputs to change the appearance or information presented to users.

• A. LDAP Injection
• B. HTML Embedding
• C. Server-side Includes
• D. HTML injection

Answer: (D)

HTML injection happens when user-supplied input is included in the page’s HTML output without proper escaping. Because the browser treats that input as markup, an attacker can insert HTML tags to change how the page looks or what information is shown to other users. For example, data entered into a vulnerable form and then echoed directly into the page could add new elements, alter layout, or display misleading content. This differs from LDAP Injection, which targets directory service queries, and from terms like HTML Embedding or Server-side Includes, which refer to different mechanisms. The best answer describes an attack that injects HTML code through vulnerable form inputs to modify what users see—HTML injection. To prevent it, ensure proper escaping or encoding of output, validate and sanitize inputs, and render user data safely.

HTML injection happens when user-supplied input is included in the page’s HTML output without proper escaping. Because the browser treats that input as markup, an attacker can insert HTML tags to change how the page looks or what information is shown to other users. For example, data entered into a vulnerable form and then echoed directly into the page could add new elements, alter layout, or display misleading content. This differs from LDAP Injection, which targets directory service queries, and from terms like HTML Embedding or Server-side Includes, which refer to different mechanisms. The best answer describes an attack that injects HTML code through vulnerable form inputs to modify what users see—HTML injection. To prevent it, ensure proper escaping or encoding of output, validate and sanitize inputs, and render user data safely.