Cross-site scripting (XSS) is a web security flaw that makes a site run attacker-controlled code in a visitor’s browser as if it were part of the trusted site. The code runs in the browser, not on the site’s server, and what it can do depends on the page, the user’s access and the browser’s protections.
How cross-site scripting works
A typical XSS flaw starts when attacker-controlled data reaches a page and the browser interprets it as executable content rather than inert text. The browser then runs that content in the vulnerable site’s context, where it may be able to read or alter page content or send requests using the visitor’s access.
As an Amazon Associate I earn from qualifying purchases.
That does not mean every XSS attack steals cookies. The outcome depends on the application, browser protections, available credentials and what the affected user can access. The name is also historical: an attack does not have to cross between two sites. The central problem is unsafe execution in the context of a trusted target site.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallWhat are the main types of XSS?
The labels describe different parts of how an attack works, and they are not mutually exclusive. Reflected and stored XSS describe how data reaches a victim; DOM-based XSS describes unsafe processing in client-side code.
#1 Best Overall
| Type | Where the data is handled | Persistence and delivery |
|---|---|---|
| Reflected | The server includes request data unsafely in its response, such as on a search-results or error page. | The application does not store the payload. It is commonly delivered in a crafted link or request that a victim opens. |
| Stored | The application saves malicious content and later includes it unsafely in a page. | The content persists in the application—for example, as a comment or forum post—and may affect multiple people who view it. |
| DOM-based | Client-side code handles attacker-controlled data unsafely and passes it to a dangerous DOM operation or other executable context. | It describes the browser-side processing, not whether the data is stored. A DOM-based flaw can also be reflected or stored. |
OWASP’s XSS types overview and testing guide for DOM-based XSS explain these distinctions.
Why XSS matters
Because the browser treats the injected code as part of the vulnerable site, it may interact with the page and make requests with the visitor’s access. A successful attack can therefore expose or change information available through that session. The practical impact varies with the site’s features, the user’s permissions and the browser’s security controls; XSS is not the same as executing code on the server.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.How to prevent XSS
The primary defense is to make untrusted data safe for the exact context where it will appear. HTML text, quoted attributes, URLs, JavaScript, CSS and DOM operations have different rules, so generic input filtering is not a replacement for context-appropriate output handling. OWASP’s XSS overview and DOM-based XSS guidance describe the risks and testing considerations.
Free tools Windows power users keep installed
One-click scans. No signup required.
Use safe output handling
- Use framework templates that escape output by default, and avoid raw-HTML escape hatches for untrusted values.
- Encode output for its destination context; an encoding suitable for HTML text is not automatically suitable for a URL, JavaScript or CSS context.
- For ordinary text in the DOM, use
textContentand create elements with safe APIs rather than inserting the value throughinnerHTML. - If the application must display user-provided HTML, sanitize it with a maintained allowlist sanitizer. Sanitization is for that specific HTML-rendering requirement, not a universal fix for every XSS data flow.
Framework auto-escaping reduces risk but does not make every operation safe: raw HTML rendering, unsafe URLs and outdated components can create openings. See OWASP’s guidance on client-side testing for DOM-related issues.
Add supporting controls
Content Security Policy and browser controls can add defense in depth, but they do not replace safe handling of untrusted data. OWASP cautions that web application firewalls are unreliable as an XSS prevention strategy, particularly for DOM-based problems; they do not fix the underlying unsafe data flow.
Trusted Types is a browser API that can require data to pass through a developer-defined transformation before reaching APIs that may execute it. MDN marks it broadly available since February 2026, while noting that older devices or browsers may lack support. Check compatibility for the actual audience before relying on it.
Quick Recap
Best Value
- Used Book in Good Condition
Rank #4
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
