Vulnerabilities with dataTables server side processing

davidreachio

I was working on a project and I needed to output user details unto dataTables from PHP MYSql. DataTable requires results to be json encoded from php but it receives it as a get mothod in javascript. Problem is that the entire results is been shown on the browser console. I just wanted it to parse straight to window but dataTables leaves references on the browser console which can cause XSS attackes because I was able to hack my data using those information on the console

allan

I don't really see how showing information on a console can lead to an XSS attack - also DataTables shouldn't be showing any JSON response on the console by default. Can you give me a link to a page showing it doing that so I can correct it please?

In terms of protecting against XSS attacks - the security documentation has details about that.

Allan