Is a web page without text fields and text areas immune to XSS?

Question

If a web page comprises of drop downs,radio buttons,check boxes etc for user input and avoid text fields and text area to evade untrusted data(malicious javascript entered by the user). Is such a web page immune to XSS? If not how to secure such an application using ESAPI.

Answer 1

You can edit the form in your browser using for example Firebug and just add any field with any name.

Even more so, you can just forge whole post/get requests with any data you like (using curl or many other tools).

So: no, it is not.

Answer 2

Not necessarily. The input type doesn't matter, because requests can be spoofed (easy with GET, but not too hard with POST requests). What matters is that the result of the form is sanitized before inserting it into the page.