Cross-site scripting (XSS) is a means of running code from one computer on another computer. It is sometimes used maliciously, either to obtain information from another computer or to change a computer’s settings. In interviews, questions with text responses provide an easy entry point for cross-site scripting because they generally accept anything that the respondent types.

One way of preventing cross-site scripting is to validate everything that the respondent types and to reject anything that does not contain characters that you deem to be valid in the response. The most common requirement is to reject responses that contain HTML tags because these could be used for introducing executable code into the response.

The interview scripting language provides the AllowXHTML option for you to specify whether or not HTML codes are acceptable in text. This option is False for all questions with text responses, so you should not normally need to do anything to prevent cross-site scripting. If you want to allow respondents to include HTML tags in their responses, set this option to True as follows:

where Name is the name of a question with a text response.

If you set AllowXHTML to True you should write your own custom validation function to check respondents' answers.

To see how this works, suppose you have the following questions in your script.

and the routing section contains:

Respondents will be able to enter anything as their first name, including HTML tags, whereas last names containing HTML tags will be rejected. If the respondent has entered HTML tags at FirstName, any scripting code inside those tags is executed when the Thanks message is displayed. If the code is malicious your system is at risk.

Disallowing HTML tags in response texts does not extend cases where you set the response to a text containing HTML characters in the routing section of the script. In the following example, respondents can enter anything they like as their profession as long as it does not contain HTML tags. However, anyone who does not answer the question will have their profession shown as “Not given” in bold regardless of the value of AllowXHTML: