Which attack involves injecting HTML into a web page through vulnerable inputs to alter content?

Which attack involves injecting HTML into a web page through vulnerable inputs to alter content?

• A. File Injection Attack
• B. HTML Embedding
• C. Server-side Includes
• D. HTML injection

Answer: (D)

HTML injection happens when untrusted input is reflected into a page’s HTML and the browser renders that input as markup. The attacker can insert HTML tags through a normal input field, and those tags become part of the page, changing how content appears or behaves. For example, if a site writes back a user’s name into the page without escaping, someone could submit tags like bold text or links, which the browser will render, altering the page’s content or layout. If scripts are included, it can escalate toward XSS, but HTML injection specifically focuses on injecting HTML that the browser interprets. This differs from file injection, which targets including or reading files on the server, and from server-side include mechanisms, which rely on the server processing include directives rather than the client rendering user-supplied markup. It also isn’t about simply embedding HTML in a page for legitimate use; it’s about injecting untrusted markup through input to manipulate what the page shows. To prevent this, sanitize and encode output so that any user-provided input is treated as text rather than markup, validate inputs, and use safe templating or frameworks that automatically escape content.

HTML injection happens when untrusted input is reflected into a page’s HTML and the browser renders that input as markup. The attacker can insert HTML tags through a normal input field, and those tags become part of the page, changing how content appears or behaves. For example, if a site writes back a user’s name into the page without escaping, someone could submit tags like bold text or links, which the browser will render, altering the page’s content or layout. If scripts are included, it can escalate toward XSS, but HTML injection specifically focuses on injecting HTML that the browser interprets.

This differs from file injection, which targets including or reading files on the server, and from server-side include mechanisms, which rely on the server processing include directives rather than the client rendering user-supplied markup. It also isn’t about simply embedding HTML in a page for legitimate use; it’s about injecting untrusted markup through input to manipulate what the page shows.

To prevent this, sanitize and encode output so that any user-provided input is treated as text rather than markup, validate inputs, and use safe templating or frameworks that automatically escape content.