XSS (Cross‑Site Scripting)
Sitecheck Team
A web security vulnerability where attackers inject malicious scripts into webpages.
Cross‑Site Scripting (XSS) occurs when an attacker is able to insert and execute malicious JavaScript in the context of another user’s browser. This typically happens due to improper input sanitization or output encoding.
Why it matters: XSS can lead to account takeover, data theft, or the spread of malware by running arbitrary code in the user’s browser.
Quick tips:
- Escape or encode user‑supplied data before inserting it into HTML.
- Use Content Security Policy (CSP) to limit permitted script sources.
- Prefer HTTP-only cookies and avoid
innerHTML/evalwith untrusted content.
See also: CSP, SQL Injection, CSRF.