XSS
XSS
ELI5 — The Vibe Check
XSS stands for Cross-Site Scripting. Hackers inject their own JavaScript into your site so when other users visit, the evil script runs in their browser. It can steal cookies, hijack sessions, or redirect users to phishing sites. The fix is always sanitize your inputs.
Real Talk
XSS (Cross-Site Scripting) allows attackers to inject client-side scripts into web pages. There are three types: Stored (persisted in DB), Reflected (URL-based), and DOM-based. Prevention requires output encoding, Content Security Policy headers, and sanitizing user-generated content.
Show Me The Code
<!-- Content Security Policy header to block inline scripts -->
<!-- In HTTP response headers: -->
Content-Security-Policy: script-src 'self' https://trusted.cdn.com
When You'll Hear This
"This form is XSS vulnerable." / "The XSS payload was injected via the URL parameter."
Related Terms
Content Security Policy (CSP)
Content Security Policy is an HTTP header that tells the browser exactly where it's allowed to load scripts, images, and other resources from.
Cross-Site Scripting (XSS)
XSS is when a hacker sneaks their own JavaScript into your website so it runs in other people's browsers.
CSRF (CSRF)
CSRF (Cross-Site Request Forgery) is when a bad website hijacks your logged-in session on a good website to do things you didn't ask for.
OWASP Top 10
The OWASP Top 10 is the security industry's greatest hits of web vulnerabilities — the 10 most common, dangerous ways apps get hacked.
Sanitization
Sanitization is cleaning up user input before using it — stripping out anything dangerous like script tags or SQL commands.