Script injection attacks typically affect non-malicious users and succeed without compromising Web applica- tion servers or networks. For example, in 2005, the self- propagating Samy worm on MySpace used script injec- tion to infect over a million users [24]. As a MySpace user viewed the MySpace page of another, infected user, the worm script would execute and send a page update request to the server, causing the worm script to be in- cluded also on the viewing user’s page. In an attempt to prevent script injection, mostWeb ap- plication servers try to carefully filter out scripts from untrusted data. Unfortunately, such data sanitization is highly error prone (see Section ). For example,.
