Fix typos in index.html

[zutshisunakshi]

No description provided.

To prevent DOM-based XSS, you should never assign untrusted user input directly to innerHTML. Instead, use a method that treats the input as plain text. In the case of this example, replacing innerHTML with either textContent or ensuring output is properly escaped before assignment is safest.
The best way to fix this specific issue:

• Change line 23 from document.getElementById('out').innerHTML = q; to document.getElementById('out').textContent = q;.

This change ensures that any characters in q with HTML significance (such as <, >, &) will be rendered as text, not interpreted as markup or script.

No new imports or library dependencies are required for this fix.

---

[Copilot]

Pull Request Overview

This PR introduces a new HTML test page designed to demonstrate XSS (Cross-Site Scripting) vulnerabilities for local testing purposes. The page contains a form that accepts user input and directly outputs it to the DOM without sanitization.

• Adds a complete HTML page with form input and JavaScript handling
• Implements vulnerable XSS behavior by directly inserting user input into innerHTML
• Includes basic form structure with submit handling and DOM manipulation

---

_{Tip: Customize your code reviews with copilot-instructions.md. Create the file or learn how to get started.}

[Copilot]

There's a typo in the heading text. 'Testt' should be 'Test'.

Suggested change

	<h1>Vulnerable Testt</h1>
	<h1>Vulnerable Test</h1>

[Copilot]

This code is vulnerable to XSS attacks as it directly inserts user input into innerHTML without sanitization. For a test page demonstrating vulnerabilities, this is intentional, but consider adding a comment explaining this is the vulnerable behavior being demonstrated.

Suggested change

	const q = document.getElementById('input').value;
	const q = document.getElementById('input').value;
	// WARNING: This is intentionally vulnerable code for XSS demonstration purposes.
	// Do NOT use this pattern in production. Always sanitize user input before inserting into innerHTML.

[Copilot]

Pull request overview

Copilot reviewed 1 out of 1 changed files in this pull request and generated 2 comments.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

The word "Testt" contains a spelling error with an extra 't' at the end. It should be "Test".

Suggested change

	<h1>Vulnerable Testt</h1>
	<h1>Vulnerable Test</h1>

[Copilot]

This code is vulnerable to Cross-Site Scripting (XSS) attacks. User input is directly inserted into the DOM via innerHTML without any sanitization. An attacker could inject malicious scripts by entering HTML/JavaScript code. Use textContent instead of innerHTML, or implement proper input sanitization if HTML content is genuinely needed.

Suggested change

	document.getElementById('out').innerHTML = q;
	document.getElementById('out').textContent = q;