Of the current attacks on Web applications, those based on script injection are by far the most prominent. For ex- ample, script injection is used in cross-site scripting [1] and Web application worms [2, 24]. A script injection vulnerability may be present when- ever a Web application includes data of uncertain origin in its Web pages; a third-party comment on a blog page is an example of such untrusted data. In a typical attack, malicious data with surreptitiously embedded scripts is included in requests to a benign Web application server; later, the server may include that data, and those scripts, inWeb pages it returns to unsuspecting users. SinceWeb browsers execute scripts on.
