Cross-Site Scripting (XSS)

In cross-site scripting, an attacker gets their own script to run in other people's browsers, usually through a comment, name or search box that the site later shows to other users without cleaning it. The script can then read the page, act as the victim, or steal their session.

The defence is output escaping: before placing user text into a page, turn the special characters <, >, & and quotes into harmless entities, so the browser shows them as text instead of running them as code. Most modern frameworks (such as React) do this by default; the danger returns when you bypass it. A Content Security Policy adds a second layer.