How to avoid JavaScript Injection attack

when I use Js API like this: abp.services.app.product.create({ name: $("[name = 'name']").val(), detail: $("[name = 'detail']").val() }) and in the text box, enter “<script>alert(" Hi “)”</script>”,This will not be Validated by API ,so If the page I want to display product information,the Script will be executed. Do I need to validate it myself ? thanks much.

[Wddzht]

OK. Thanks much. ABP can automatically generate Web API layer and also provide Dynamic Javascript Proxies . So I guessed it can avoid JavaScript Injection attack automatically like MVC:[ValidateInput(true)] before. If I submit forms rashly in this way ,there may have potential danger. So I take the liberty of thinking that ABP needs to provide this validation and open it by default 😃

[ismcagdas]

Hi,

We will consider this for the future but for now you need to handle it manually.