XSS

Definition

Cross-Site Scripting (XSS) is a security vulnerability that allows an attacker to inject malicious scripts into content from otherwise trusted websites. This occurs when an application includes untrusted data in a web page without proper validation or escaping, enabling attackers to execute scripts in the user’s browser. XSS can lead to session hijacking, defacement, or redirecting users to malicious sites.

Secure Settings Example

<!-- Example of escaping user input in a web application using a templating engine -->
<p>{{ user_input | escape }}</p>

Insecure Settings Example

<!-- Example of directly inserting user input into HTML without escaping -->
<p><?php echo $_GET['user_input']; ?></p>