> For the complete documentation index, see [llms.txt](https://notes.anggipradana.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://notes.anggipradana.com/tutorial/dvwa/cross-site-scripting-xss/stored/medium.md).
# Medium
Di bawah ini adalah *source-code* dari XSS (Stored) level medium di DVWA.
```php
vulnerabilities/xss_s/source/medium.php
', '', $name );
$name = ((isset($GLOBALS["___mysqli_ston"]) && is_object($GLOBALS["___mysqli_ston"])) ? mysqli_real_escape_string($GLOBALS["___mysqli_ston"], $name ) : ((trigger_error("[MySQLConverterToo] Fix the mysql_escape_string() call! This code does not work.", E_USER_ERROR)) ? "" : ""));
// Update database
$query = "INSERT INTO guestbook ( comment, name ) VALUES ( '$message', '$name' );";
$result = mysqli_query($GLOBALS["___mysqli_ston"], $query ) or die( '' . ((is_object($GLOBALS["___mysqli_ston"])) ? mysqli_error($GLOBALS["___mysqli_ston"]) : (($___mysqli_res = mysqli_connect_error()) ? $___mysqli_res : false)) . '
' );
//mysql_close();
}
?>
```
## Mencari Informasi
Setelah saya coba-coba dan melihat *source code* pada form **Name**, tag `