[Security] Implement Client-Side Input Sanitization and XSS Prevention for All Forms

[knoxiboy]

Title: [Security] Implement Client-Side Input Sanitization and XSS Prevention for All Forms

Description
The login (login.js), registration (register.js), checkout (checkout.js), and contact forms accept user input without sanitization. Script injection via form fields could lead to XSS attacks stored in localStorage or rendered in DOM.

Motivation
Even in a frontend-only application, XSS through innerHTML assignments or localStorage poisoning can steal session data or redirect users to phishing sites.

Implementation Suggestions

1. Create a sanitize.js utility module with functions: escapeHTML(), sanitizeInput(), validateEmail().
2. Import and apply sanitization to all form submissions in login.js, register.js, checkout.js, and contact.html.
3. Replace all innerHTML assignments with textContent where dynamic user data is rendered.
4. Add Content-Security-Policy meta tag to all HTML files to block inline scripts.

Level: Critical
Affected Files: sanitize.js (new), login.js, register.js, checkout.js, all .html files

[knoxiboy]

/assign gssoc'26
@janavipandole Please assign this issue to me

[aaniya22]

pls assign this under gssoc

[karrisanthoshigayatri]

Hi @janavipandole ,

I would like to work on this Critical Security issue under GSSoC'26.

My implementation plan includes:

• Creating a reusable sanitize.js utility with functions such as escapeHTML(), sanitizeInput(), and validateEmail().
• Applying input sanitization and validation across all forms (login.js, register.js, checkout.js, and contact forms).
• Replacing unsafe innerHTML usage with textContent (or other safe DOM methods) wherever user-generated content is rendered.
• Adding an appropriate Content Security Policy (CSP) meta tag to the HTML files to strengthen protection against XSS attacks.
• Ensuring the changes remain consistent with the existing project structure without affecting current functionality.

Please assign this issue to me. Thank you!

[MamidiDhana]

Hi @janavipandole,
I would like to work on this security enhancement under GSSoC'26.
I have reviewed the requirements and can implement a reusable sanitize.js utility to provide consistent input sanitization and validation across all forms. I will replace unsafe DOM updates with secure alternatives, strengthen XSS protection, and ensure the implementation integrates seamlessly with the existing codebase without affecting current functionality.
Kindly assign this issue to me. Thank you!