What is cross-site scripting (XSS) and how can it be prevented?

What is cross-site scripting (XSS) and how can it be prevented?

• A. A method of improving password security.
• B. A vulnerability in email phishing.
• C. A type of SQL injection.
• D. A web vulnerability where attackers inject scripts; prevent with input validation, output encoding, and CSP.

Answer: (D)

Cross-site scripting is a web vulnerability where attackers inject malicious scripts into pages that other users view, causing those scripts to run in the victim’s browser as if they came from the trusted site. This can lead to stolen cookies, session hijacking, or delivering harmful content to users. Prevention focuses on a few solid defenses. Input validation helps by checking and cleaning incoming data so untrusted content isn’t stored or reflected back into pages. Output encoding (escaping) ensures that any user-supplied data is treated as data, not executable code, when it’s rendered in the browser. Content Security Policy (CSP) adds an extra layer by restricting which scripts can run, where they can be loaded from, and whether inline scripts are allowed. Together, these measures make it much harder for injected scripts to execute and protect users from XSS. It’s not about password security, it’s not a vulnerability of email phishing, and it’s not a type of SQL injection. Those describe different security issues (protecting passwords, phishing risks, and database-oriented attacks, respectively) rather than attacks against the browser via script injection.

Cross-site scripting is a web vulnerability where attackers inject malicious scripts into pages that other users view, causing those scripts to run in the victim’s browser as if they came from the trusted site. This can lead to stolen cookies, session hijacking, or delivering harmful content to users.

Prevention focuses on a few solid defenses. Input validation helps by checking and cleaning incoming data so untrusted content isn’t stored or reflected back into pages. Output encoding (escaping) ensures that any user-supplied data is treated as data, not executable code, when it’s rendered in the browser. Content Security Policy (CSP) adds an extra layer by restricting which scripts can run, where they can be loaded from, and whether inline scripts are allowed. Together, these measures make it much harder for injected scripts to execute and protect users from XSS.

It’s not about password security, it’s not a vulnerability of email phishing, and it’s not a type of SQL injection. Those describe different security issues (protecting passwords, phishing risks, and database-oriented attacks, respectively) rather than attacks against the browser via script injection.