{% extends "exercise_base.html" %}

{% block title %}{{ block.super }}XSS via Form Field Injection{% endblock %}

{% block header %}
    <h1>XSS via Form Field Injection</h1>
{% endblock %}

{% block extra_js %}
{{ block.super }}
<script src="{{STATIC_URL}}js/exercises/xss-form.js"></script>
{% endblock %}

{% block content %}
<p>Users can never be trusted. They are all out to take advantage of
us and other users of your websites.</p>

<p>In this exercise we're going to try to "steal" the current user's cookie.
Take that cookie and put it in <code>div#cookie</code> using the element's
<code>innerHTML</code> property.</p>

<div id="cookie">Put the cookie in this div.</div>

<div id="result"></div>

<fieldset>
<form method="get">
    <input type="text" name="qs" id="qs" value="{{qs|safe}}">
    <input type="submit" value="Submit">
</form>
</fieldset>

{% if qs != "hello" %}
    <a class="tiny button" id="show_solution">show solution</a>
{% endif %}
    <div class="solution panel"></div>
{% endblock %}

{% block extra_topnav %}
<li><a href="{% url 'xss-query' %}?qs=awesome">Prev</a></li>
<li><a href="{% url 'direct-object-references' %}">Next</a></li>
{% endblock %}

{% block extra_botnav %}
<li><a href="{% url 'xss-query' %}?qs=awesome">Prev</a></li>
<li><a href="{% url 'direct-object-references' %}">Next</a></li>
{% endblock %}
