Glossary / Security & encryption

XSS (Cross-Site Scripting)

XSS is an attack where malicious script is smuggled into a page other users view — through a comment field, a URL parameter, anywhere input isn't properly sanitized. The injected script then runs in victims' browsers with the site's own privileges, stealing sessions or data. The cure is engineering discipline: escape all output, sanitize all input, and enforce a strict Content Security Policy.