Web vulnerability where an attacker injects malicious scripts into content that other users view.
When the victim’s browser executes the injected script, it can steal data, deface pages, or perform actions on behalf of the user.
Types
There are three main types of XSS:
Reflected XSS: The user input is displayed on the page after processing.Stored XSS: User input is stored in the back end database and then displayed upon retrieval.DOM XSS: User input is directly shown in the browser and written to HTML DOM objects.
Prevention
Having a browser that blocks automatic execution of JavaScript code.
Sanitising user input to ensure that it is not JavaScript code.