Cybersecurity / Feb 08, 2026
Understanding Cross-Site Scripting (XSS)
Archived article · Content reflects its original publication date and has not been fact-checked in this redesign. Not current market or investment guidance.
Understanding Cross-Site Scripting (XSS)
Date: Feb 08, 2026
Category: Web Security
Illustration unavailable — the original article contains a placeholder image.
What is XSS?
Cross-Site Scripting (XSS) is a vulnerability that allows attackers to inject malicious scripts into web pages viewed by other users. This bypasses the Same Origin Policy (SOP).
Types of XSS
1. Reflected XSS
The malicious script comes from the current HTTP request. * Example: Search bars that echo the input without sanitization. * Impact: Session hijacking, phishing.
2. Stored XSS
The malicious script is stored on the target server (database, forum post, comment field).
* Example: A comment on a blog that contains <script>alert(1)</script>.
* Impact: Persistent attack on anyone who views the page.
3. DOM-based XSS
The vulnerability exists in client-side code rather than server-side code.
Prevention
- Input Validation: Validate everything on arrival.
- Output Encoding: Encode data before rendering it to the browser.
- Content Security Policy (CSP): Restrict the sources of executable scripts.
// BAD
document.body.innerHTML = userInput;
// GOOD
document.body.innerText = userInput;