#0906
Your application displays user profile fields (bio, display name, etc.) in HTML pages viewed by other users.
The current sanitiseProfileField function strips only the literal string <script>, leaving uppercase variants like <SCRIPT> and event-handler tags like <img onerror=...> completely unhandled.
A stored XSS payload in a profile bio can execute JavaScript in every visitor's browser, enabling session hijacking and credential theft.
Stored XSS in profile fields is one of the most dangerous vulnerability classes because the payload fires for every user who views the profile, multiplying impact across the entire user base.
sanitiseProfileField with proper HTML entity encoding.& → &, < → <, > → >, " → ", ' → '.sanitiseProfileField('<SCRIPT>alert(1)</SCRIPT>')// returns '<SCRIPT>alert(1)</SCRIPT>' — not blocked!
sanitiseProfileField('<SCRIPT>alert(1)</SCRIPT>')// returns '<SCRIPT>alert(1)</SCRIPT>'
& first to prevent double-escaping.