Update: It seems that the pressure of the backlash and Firefox' AMO policy has prevailed, and the NoScript extension has been "un-eviled". For now. Trust is a lot harder to regain, however, and I will not be using it again for my part.

So I was sifting through my logs and found a well-executed, actual XSS attack on one of my pages in the Ermarian Network.

As XSS attacks go, it was fairly harmless: The attacker injected an HTML link that was displayed after the form field; the HTML link did not go anywhere. Really a proof of concept, and an (intentional?) heads up that I should secure my site better.

On occasion, a webmaster will want a select field on their web site to act like a drop-down menu: A way of opening a certain page simply by expanding the menu and clicking a certain option.

As an example:

Half a year ago, I wrote two short guides on how to use PHP to get "clean resource identifiers" for your website. A "clean" address, in this case was considered a sensible, short and memorable name that could be easily printed on paper or dictated, which did not depend on the location of the files and which (importantly) did not have a file extension like .php or .html.