What is Cross-site scripting?
Also called: XSS
The short answer
Cross-site scripting is an attack where malicious code is injected into a page and runs in other visitors' browsers, stealing sessions or data.
Cross-site scripting, explained
Escaping all user-supplied content before displaying it, and a Content Security Policy, prevent it. Modern frameworks escape by default.
Questions people ask about Cross-site scripting
What is Cross-site scripting?
Cross-site scripting is an attack where malicious code is injected into a page and runs in other visitors' browsers, stealing sessions or data.
Related terms
A Content Security Policy is a response header that tells the browser which sources of scripts, styles, images and frames a page may load, blocking injected code.
Website securityWebsite security is protecting a site, its data and its visitors from attacks, through HTTPS, updated software, careful input handling, strong logins and backups.
Cross-site request forgeryCross-site request forgery tricks a logged-in user's browser into sending an unwanted request, such as changing an email address, to a site they trust.
SQL injectionSQL injection is an attack that slips database commands into form fields or URLs, letting an attacker read or change data the site never meant to expose.
Part of the Web Encyclopedia by Apex Flow Digital. Definitions are general knowledge, kept current, with no invented statistics.