Which practice is recommended to prevent cross-site scripting in web applications?

Which practice is recommended to prevent cross-site scripting in web applications?

• A. Disabling all JavaScript in the browser.
• B. Input validation, output encoding, and content security policy.
• C. Relying solely on server-side code without validation.
• D. Using only GET requests.

Answer: (B)

Cross-site scripting can happen when untrusted input is reflected or stored and then executed by the browser. The strongest defense is a layered approach: validate inputs, encode outputs, and enforce a content security policy. Input validation helps by rejecting obviously dangerous data before it’s stored or echoed back to the user. But validation alone isn’t enough because there are many ways to bypass checks or handle edge cases, so it must be combined with other safeguards. Output encoding is crucial because it treats user-supplied data as data, not code. When data is placed into HTML, JavaScript, or URLs, encoding ensures characters like <, >, ", ', and & are turned into safe text rather than interpreted as part of a script. The correct encoding depends on the context—HTML content, attribute values, JavaScript, or URLs—so applying the right escaping for each context is essential. A Content Security Policy adds an additional barrier by restricting what sources of scripts and other resources are allowed to run and by disallowing inline scripts. This reduces the impact of any XSS vulnerability, because even if malicious code makes it to the page, the browser is blocked from executing it. Other options fall short because turning off JavaScript in the browser isn’t feasible for real-world applications, relying only on server-side code without proper validation and encoding leaves rendering of data vulnerable, and using only GET requests doesn’t address the fundamental risk of script execution in the browser.

Cross-site scripting can happen when untrusted input is reflected or stored and then executed by the browser. The strongest defense is a layered approach: validate inputs, encode outputs, and enforce a content security policy.

Input validation helps by rejecting obviously dangerous data before it’s stored or echoed back to the user. But validation alone isn’t enough because there are many ways to bypass checks or handle edge cases, so it must be combined with other safeguards.

Output encoding is crucial because it treats user-supplied data as data, not code. When data is placed into HTML, JavaScript, or URLs, encoding ensures characters like <, >, ", ', and & are turned into safe text rather than interpreted as part of a script. The correct encoding depends on the context—HTML content, attribute values, JavaScript, or URLs—so applying the right escaping for each context is essential.

A Content Security Policy adds an additional barrier by restricting what sources of scripts and other resources are allowed to run and by disallowing inline scripts. This reduces the impact of any XSS vulnerability, because even if malicious code makes it to the page, the browser is blocked from executing it.

Other options fall short because turning off JavaScript in the browser isn’t feasible for real-world applications, relying only on server-side code without proper validation and encoding leaves rendering of data vulnerable, and using only GET requests doesn’t address the fundamental risk of script execution in the browser.