Cross-site scripting (XSS)

What it is

XSS lets an attacker run JavaScript in your users' browsers — stealing sessions, defacing the page, or pivoting to admin accounts.

How attackers exploit it

Anywhere your site outputs user-controlled data without escaping (a search box, profile name, comment) can become an XSS sink.

How to protect against it

• HTML-escape on output. Use a framework that auto-escapes (React, Svelte) and never use `dangerouslySetInnerHTML` with user content.
• Set a strict Content-Security-Policy with nonces — no `unsafe-inline`, no `*`.
• Mark session cookies HttpOnly so JS can't read them even if XSS lands.
• Sanitize HTML with a library like DOMPurify when you must render rich text.

• PortSwigger — XSS
• OWASP XSS Prevention Cheat Sheet