XSS Attack, Explained: How It Works and How to Prevent It

Cross-Site Scripting (XSS) is one of the oldest entries on the OWASP Top 10, and it is still everywhere — in comment boxes, search results, profile fields, even URL parameters reflected back onto a page. It survives because the mistake is easy to make and easy to miss in review: a piece of user data gets printed into HTML without being escaped.

This note is a compact tour. By the end you should be able to explain what XSS is, spot the pattern that causes it, tell the three attack types apart, and know exactly which techniques stop it.

The one-sentence definition

XSS happens when data supplied by a user is allowed to be interpreted as HTML or JavaScript by the browser, instead of being treated purely as text on the page.

Everything else in this article is a consequence of that sentence.

Continue reading …

https://milandawijekoon.github.io/blog/xss-attack-explained-and-how-to-prevent-it/