Search code examples
discorddiscord.jsxss

Are modals secure against XSS, SQL injection or other attacks?


Discord lets us have the ability to create modals which are basically submission forms. Are the modals secure against attacks like XSS or SQL injections so that we don't need to sanitize user inputs anymore?

I've tried doing <script>alert(1);</script> on one of my modal fields and it didn't do anything, but I only tested that on the Discord app. I'm not sure if the result will change if it's done on the browser.


Solution

  • No. Modals are a form of user input, Discord may indeed do some filtering of it yet it will not be guaranteed, if you are using user input in any of your database queries or on a web page connected to your application the information gathered from modals is still vulnerable to common injection attacks.

    If you are worried about the sanitization, here is a good page from OWASP on input sanitization. https://cheatsheetseries.owasp.org/cheatsheets/Input_Validation_Cheat_Sheet.html