MY ONE BLOGby Manishdai
Cybersecurity

What is XSS?

Quick answer

Cross-Site Scripting: a web vulnerability that lets attackers inject malicious scripts into pages viewed by other users.

XSS, explained

XSS happens when a website includes untrusted input in a page without properly handling it. For example, if a blog's comment section displays comments exactly as submitted, an attacker could post a comment containing a script. Every visitor who views that page would then run the attacker's code in their browser.

Malicious scripts can steal session cookies, capture keystrokes, redirect users to phishing sites, or perform actions on their behalf. Main types include stored XSS, saved on the server; reflected XSS, bounced off a link; and DOM-based XSS, which occurs in client-side code. Defenses include encoding output correctly for its context, using frameworks that escape content by default, sanitizing any allowed HTML, and setting a strong Content Security Policy.

Related terms

Frontend

The part of an application that users see and interact with directly, such as web pages and app screens.

SQL Injection

An attack in which malicious input is inserted into a database query, tricking the application into exposing or altering data.

Vulnerability

A weakness in software, hardware, configuration, or process that an attacker could exploit to cause harm.

Guides that mention XSS