# Understanding Cross-Site Scripting (XSS)

**Date:** Feb 08, 2026  
**Category:** Web Security

![XSS Diagram](https://placehold.co/800x400/1a1a2e/bc13fe?text=XSS+Attack+Vector)

## What is XSS?
Cross-Site Scripting (XSS) is a vulnerability that allows attackers to inject malicious scripts into web pages viewed by other users. This bypasses the Same Origin Policy (SOP).

## Types of XSS

### 1. Reflected XSS
The malicious script comes from the current HTTP request.
*   **Example**: Search bars that echo the input without sanitization.
*   **Impact**: Session hijacking, phishing.

### 2. Stored XSS
The malicious script is stored on the target server (database, forum post, comment field).
*   **Example**: A comment on a blog that contains `<script>alert(1)</script>`.
*   **Impact**: Persistent attack on anyone who views the page.

### 3. DOM-based XSS
The vulnerability exists in client-side code rather than server-side code.

## Prevention
1.  **Input Validation**: Validate everything on arrival.
2.  **Output Encoding**: Encode data before rendering it to the browser.
3.  **Content Security Policy (CSP)**: Restrict the sources of executable scripts.

```javascript
// BAD
document.body.innerHTML = userInput;

// GOOD
document.body.innerText = userInput;
```