title: Cross Site Scripting issue with window.location.search
body: <p>I have been going through so many forums &amp; wikipedia's since few days for trying to understand about XSS attacks alomost I have spent 2-3 days but still not get better idea as suggesting multiple solutions by experts &amp; I want know how the hackers can inject malicious code on victims browser ? and my application have been use to run on some App Scanner standard testing tool so its caught so many XSS issues. I want put here one of XSS issue of my application so can please some one help me out to understand the what exactly I have to do for this issue. Still I have been trying a lot to get better understand about XSS issues. This is my code snippet </p>
  
  <p><div class="snippet" data-lang="js" data-hide="false" data-console="true" data-babel="false">
  <div class="snippet-code">
  <pre class="snippet-code-js lang-js prettyprint-override"><code>function getParameter(param) {
          var val = "";
          var qs = window.location.search;
          var start = qs.indexOf(param);
          if (start != -1) {
                  start += param.length + 1;
                  var end = qs.indexOf("&amp;", start);
                  if (end == -1) {
                          end = qs.length
                  }
                  val = qs.substring(start,end);
          }
          return val;
  }
  
  var formName = getParameter("formName");
  var myValue = '&lt;a href="javascript:parent.opener.assignDateIps( new Date(\''+year+'\',\''+month+'\',\''+thisDay+'\'), \''+contextstr+'\', \''+formName+'\' );window.close()" class="modulelink"&gt;'+thisDay+'&lt;/a&gt;&lt;/td&gt;';
  document.getElementById('calendarA').innerHTML = myValue;</code></pre>
  </div>
  </div>
  </p>
  
  <p>And these statements are </p>
  
  <pre><code>var qs = window.location.search;
  val = qs.substring(start,end);
  var formName = getParameter("formName");
  var myValue = '&lt;a href="javascript:parent.opener.assignDateIps( new Date(\''+year+'\',\''+month+'\',\''+thisDay+'\'), \''+contextstr+'\', \''+formName+'\' );window.close()" class="modulelink"&gt;'+thisDay+'&lt;/a&gt;&lt;/td&gt;';
  document.getElementById('calendarA').innerHTML = myValue;
  </code></pre>
  
  <p>cought by App scanner testing tool as possible code for XSS(Cross Site Scripting) issues but I am not sure how it is cause to XSS &amp; how I can fix this issue now. Can anybody please provide insights on how this vulnerability can be fixed?</p>